Menu

Articles & Blogs

Questions to Ask my SOC2 Auditor before Signing up for a SOC 2 Compliance Audit

December 6, 2022 | By Accorian
SOC2 Compliance Audits

Written By Om Hazela & Sarthak Makkar ||

  Ideally You want to find a service provider to take you from SOC 2 readiness to report. 

SOC 2 is a third-party review that attests the organization’s ability to protect the data and information they process and store. Given the current scenario where a lot of data breaches and cyberattacks are on the rise, a SOC 2 report help organizations empower with:
• Enhance one’s view into your organization’s security posture
• Identify opportunities for improvement over existing controls
• Position your company competitively in the market (Prospects want to ensure Security is considered a priority in your organization).

Many vendors offer different aspects of the SOC 2 process, from software providers who help you get audit-ready, to certified auditors from CPA firms who can assess your infrastructure and release a final SOC 2 report.

Ideally, you will want to find a service provider to take you from SOC 2 readiness to report.

Use these points to help you assess a vendor/service provider before signing a contract for your organization’s SOC 2 Assessment. These questions will provide you with clarity about your requirements for SOC 2 and how a service provider will be able to help you, from preparing your organization to getting attested for SOC.

1. Are you a licensed CPA firm? 

The American Institute of Certified Public Accountants (AICPA) regulates SOC 2 audits, which must be carried out by an external auditor from a certified CPA firm. This is the only way you, as a company, can get an official SOC 2 report. Verifying that the SOC 2 vendor you are considering working with has the required accreditation is essential.

2. Do you offer SOC 2 readiness services? 

Before you carry out a formal audit, a SOC 2 readiness assessment is a helpful way to assist you in evaluating your company’s posture. Before a SOC 2 audit, gaps in your cybersecurity procedures that need to be closed (and their severity) can be identified using a readiness assessment. Ultimately, this will help you save time, establish priorities, and position your business to perform well during the SOC 2 assessment.

 3. Evidence collection and validation

The evidence collection processes for SOC 2 Type 1 and Type 2 are very similar. The evidence is the same whether it is SOC 2 Type 1 or Type 2; they both cover a moment in time or a period of time. Thus, you could be required to submit the most recent Board of Directors meeting minutes for Type 1. However, if Type 2 applies to you, you must present those minutes for each quarter of your observation time. For a Type 2, there is more proof to gather, but the information is the same as a Type 1.

4. How long does it take to complete a SOC 2 assessment?

Many service providers claim to be able to finish a SOC 2 audit in 14 days. This clause should be clarified before a contract is signed. Although evidence collection is essentially one phase in the SOC 2 audit process and does not always lead to a full audit or final report, the two-week schedule is frequently used as an estimate for an expedited evidence collection procedure.

Demand a detailed timeline from your vendor and ask them to walk you through each phase of the SOC 2 audit. This is crucial so that you can allocate resources effectively. Additionally, it is critical to understand when you might anticipate receiving a report to effectively interact with potential customers who inquire about a SOC 2 report during the sales process.

5. Can you provide us with a final report?  

Many SOC 2 service companies can only help you assess your readiness to conduct a SOC 2 audit using a tool. However, they are often unable to perform the audit and produce the SOC 2 report.

Make sure the company you choose for your SOC 2 compliance also provides audit services that will result in a SOC 2 report without forcing you to switch vendors in the middle of the audit process. As mentioned earlier, an auditor employed by a licensed CPA firm is the only one who can produce a final report.

Make sure a service company you choose to partner with likewise employs capable auditors. If not, you must permit a second vendor to perform the audit process. This is not recommended since there is a high likelihood of information being “lost in transition” between the two entities, squandering time and resources and pushing back the deadlines for audits and reports.

6. How many SOC 2 audits have you completed to date? 

Experience cannot be substituted. The choice of an experienced SOC 2 auditor can be the difference between a quick and pleasant audit procedure that yields a trustworthy final report and receiving a piece of paper that no one will accept.
You may get a sense of a company’s experience by asking them how many audits they have already conducted by looking at the tools and information they offer about the SOC 2 process on their website. A dependable and knowledgeable partner should be able to give you enough information on the SOC 2 procedure and complete details about their products and services.

7. What industries do you have experience with?

In addition, for your SOC 2 auditor to comprehend how the SOC 2 criteria apply to your firm, you will want to ensure they are knowledgeable about the ins and outs of your industry. Additionally, many SOC 2 components overlap with those of other crucial, sector-specific assessments. For instance, the overlap between SOC 2 and HIPAA (Healthcare Insurance Portability and Accountability Act) compliance would be known to your auditor if they have experience in the healthcare industry. They might be able to provide you with a combined SOC 2 + HIPAA security evaluation. By doing this, you could finish both audits simultaneously and conserve time and resources.

8. What Other services do you provide that could help as we continue to grow as a company?

SOC 2 is one of several significant audits and assessments conducted in the compliance and cybersecurity fields. It is typical for businesses to seek additional compliance initiatives after completing a SOC 2 audit.
SOC 2 also overlaps with other audit criteria, as was previously indicated. Having completed a SOC 2 audit, you are well-positioned to pursue additional complementary certifications. Find a provider that provides additional audits, attestations, and assessments to build a long-term engagement that satisfies all of your compliance and cybersecurity requirements. To avoid duplicating fieldwork and evidence-collection activities, it is advantageous to establish a partnership with one vendor.

SOC2 Compliance

Recent Blog

Article

Adobe's Common Controls Framework of Industry-acclaimed security standards

Today’s world is an ever-changing scenario with changes to the technology sector happening more frequently than ever due to emerging technologies. The case is quite similar in the field of Cyber Security. There are a few industry-acclaimed cybersecurity standards for governing the processes and execution of these standards. These standards are usually built upon a framework of control objectives that need to be implemented by the organizations to comply with these standards. Compliance is measured in terms of control objectives meeting the compliance criteria and also other regulatory and statutory criteria. Since most of these Cybersecurity standards speak of similar control objectives or lay emphasis on similar control areas, it is advisable to have the ‘Adobe’s Common Control Framework’, which means that if we are able to comply with a single requirement from a particular framework, in theory, we should be able to use the adherence of that requirement for ALL the similar frameworks. There are several approaches to achieving this Adobe's Common Controls Framework both in theory and in practice and will be discussed in detail later on in this article. The most relevant security and privacy frameworks are ISO 27001, NIST, PCIDSS, GDPR, SOC Type 2. There is a significant overlap of controls contained in these standards as all of these standards primarily deal with one requirement which is the protection of data. Protection of information from unauthorized disclosure, compromise, and theft forms the backbone or the building blocks of an Adobe's Common Control Framework. This leverages the fact that similar controls or that the essence of the controls is the same across standards and can be used to gauge the adherence or compliance of an organization to the standard. In actual execution, while gauging the compliance of an organization, the Adobe's Common Controls Framework is not only holistic but can reduce the effort and cost otherwise required by the organization to comply with individual standards. There are two methods of developing the Adobe's Common Control Framework for an organization and there are very subtle differences between the two methods. They are Controls harmonization and Controls Mapping. Controls Harmonization: Harmonization is the creation of a brand-new control language set from several source languages of standards taking into consideration content & context. In theory, the intent and meaning of the words and sentences remain intact, but the language and actual words of the individual standards have been changed with a new harmonized meaning defined. To achieve the usage of a single language as an industry, globally, it would have significant benefits and it would be the most efficient way to operate not only as security professionals but also as humans. Adobe’s Common Control Framework is an example of this type of construct. The benefits of having a single operating language can truly be amazing in terms of effort reduction and cost reduction. Control Mapping: Today, most brilliant and forward-thinking security professionals are using the control mapping method. The main idea behind this method is to keep the original language intact as much as possible while mapping and matching the intent and meaning of each sentence and word. This is the most practical and realistic approach because this is how humans fundamentally interact with each other globally. One can see this working in real life where two different languages are being spoken by individuals and kept mainly intact, but an interpreter or linguist is translating between the two — the map is developed in the mind of the linguist. Some real-life examples of mapping for cybersecurity frameworks can be seen in HITRUST Framework, Cloud Security Alliance Framework, and even the U.S. Government formally...

View More

Article

Risk Management Framework – Managing & Measuring what matters

A risk management program allows you to manage overall information security risk.  It is an approach to identify, quantify, mitigate, and monitor risks.  The reason to look at risk in a comprehensive manner is to make sure no one area is getting too much attention or, too little. Frameworks also help you identify the bigger elements of risk that need review and mitigation. Additionally, it help you to prioritize the treatment of certain risks. The adherence to risk frameworks also helps give your customers comfort that a standard risk management is in place and hence, reduce your audit burden.  Typically, a Risk Management program comprises of the following phases: Risk identification Risk analysis Risk evaluation Risk treatment Risk Monitoring A good risk management framework will have the following characteristics: Comprehensive in types of risks it covers Practical for an organization to implement Updated with current real-world risks Based on controls that can be reviewed and audited Reliable so that your vendors and customers can accept it There are many risk management frameworks that one can choose from and it important to understand the advantages of each. Common risk management frameworks include: NIST CSF SOC 2 ISO 27001 HITRUST NIST (National Institute of Standards and Technology) framework is a comprehensive cybersecurity framework (CSF).  It is very widely accepted across different company sizes and business domains. Most cyber-security professionals are well aware of this framework as it is readily available.  Although widely available and very popular there is no certified third-party audit mechanism. Hence, it can only be self-assessed.   SOC 2 Type 2 is an internal controls report based on the scope you define.  It is widely used in the United States to show the maturity of your controls.  A CPA firm that is part of the American Institute of CPAs (AICPA) conducts the audit & issues an assessment report.  The AICPA does not audit/review the assessment for completeness or quality.  HITRUST CSF is a framework that came leverages NIST, SOC, and ISO along with others to create a more comprehensive standard.  It is widely implemented in the United States by organisations in the healthcare space.  Unlike others, although there are external assessors that are involved in the certification process, HITRUST reviews all assessments and issues the certificate. Additionally, among all the frameworks above it tends to be the most expensive to implement.  It is important to choose a framework that matches your long-term security goals & needs.  At Accorian, we work with all of the above frameworks. We help organizations choose the right framework and aid with the implementation. This is done by augmenting our team into your security team to help steer the rollout, aid with query resolution, choosing of the right controls & workaround during mitigation advisory, facilitating the selection of vendors & products and end to end program management. 

View More

Ready to Start?

Security Compliance & Assessment Services

CONSULTING & ASSESSMENT SERVICES

PENETRATION TESTINGRed TEAM ASSESSMENTS
TECHNOLOGY STAFFING

Contact Info

E. info@accorian.com

T. +1-732-443-3468

Contact With Us

Office Address

Accorian Head Office

6,Alvin Ct, East Brunswick, NJ 08816 USA

Accorian Canada

Toronto

Accorian India

Ground Floor,11, Brigade Terraces, Cambridge Rd, Halasuru, Udani Layout, Bengaluru, Karnataka 560008, India

Ready to Start?​

Drop your CVs to joinourteam@accorian.com

Interested Position

Download Case study

Download SOC2 Guide