SOC 2

SOC 2 (Service Organisation Control Type 2)

SOC 2

Companies face a growing threat environment, making information and data security a top priority. A single data breach can cost millions, not to mention the blow to reputation and the loss of trust of customers. Cybersecurity requires defining frameworks – guiding principles and best practices that companies must follow to ensure information security. SOC 2, or Service Organisation Control Type 2, is a cybersecurity framework developed by the American Institute of Certified Public Accountants (AICPA). Main? The aim is to ensure that service providers store and process customer data in a secure manner.

While standards such as ISO/IEC 27001 and PCI DSS have strict requirements regarding cybersecurity controls, this is not the case with SOC 2. Each company designs and adopts its own controls depending on its operating models. An independent auditor is then appointed to verify that the company's controls meet the requirements of SOC 2. After the audit, the auditor writes a report on how well the company's systems and processes comply with SOC 2.

SOC 2 defines the requirements for managing and storing customer data based on five Trust Service Criteria (TSC):

Certainty. Generally speaking, the principle of security requires the protection of data and systems against unauthorized access. To this end, it may be necessary to implement some form of access control, implement firewalls with strict rules on incoming and outgoing traffic, introduce intrusion detection and recovery systems, and use multi-factor authentication.

Confidentiality. Data is considered confidential if only a certain group of people have access to it. This can include app code, usernames and passwords, bank card or business plan information, and more. To comply with this principle, confidential data must be encrypted, both at rest and in transit, respecting the principle of least privilege, i.e. granting the minimum rights that people need to do their jobs.

Availability. This requires building systems that ensure the availability of services at all times, resistant to errors and high traffic. This principle requires organizations to use network monitoring systems and create and use disaster recovery plans.

Confidentiality. The collection, storage, processing, and disclosure of any personal information (PII) must adhere to the organization's data use and privacy policy, along with the terms set by the AICPA in the Generally Accepted Privacy Principles (GAPP). An organization must enforce strict controls to protect PII from unauthorized access.

Integrity of processing. All systems must always function as intended, without delays, vulnerabilities, errors or bugs. Data processing must be complete, valid, accurate, timely and authorized. However, the integrity of the processing does not necessarily mean the integrity of the data. If the data contains errors before it is entered into the system, it is usually not the responsibility of the processor to detect them. Monitoring data processing, combined with quality assurance procedures, can help to ensure the integrity of processing.

To satisfy the five principles of TSC, you must answer the following questions regarding:

• Information security: how is data protected from unauthorized access and use?
• Logical and physical access control: how to manage and restrict logical and physical access to prevent unauthorized use?
• System operations: what are the systems for detecting and mitigating process deviations and how are they managed?
• Change Management: How do you implement a controlled change management process and prevent unauthorized changes?
• Risk mitigation: how to identify and reduce the risk of disruption in business and services?

Types of SOC 2 Reports

SOC 2 reports are of two types:

• Type I SOCs evaluate the company's controls at one particular moment. They provide an answer to the question: are the security controls properly designed?
• Type II SOCs assess how these controls function over a period of time, typically 3 to 12 months. They answer the question: do the security controls that a company has function as intended?

To choose between the two, think about your goals, costs, or constraints, for example, in time.

SOC 2 audit results
Each organization that has passed a SOC 2 audit receives a report, regardless of the audit result. Here are the terms that auditors use to describe audit results:

• становище без забележки (Unqualified Opinion): компанията е преминала одита без резерви и ограничения. Това означава, че контролите, които одиторът е проверил, са проектирани и работят точно както трябва.
• становище със забележки (Qualified Opinion): компанията премива одита, но някои области изискват внимание. По време на одита една или повече контроли, включени в оценката, не са проектирани или внедрени по подходящ начин.
• отказ (Disclaimer Opinion): организацията не е предоставила на одитора достатъчно информация и те не са успели да съставят мнение дали отговаряте на изискванията на SOC 2.
• неблагоприятно становище (Adverse Opinion): организацията не отговаря на един или повече от стандартите за съответствие. Считани за най-ниското мнение в доклад на SOC 2, неблагоприятните мнения казват на клиентите, че не трябва да се доверяват на системите на организацията

Who needs a SOC 2 report?
If you're a service provider that stores, processes, or transmits some type of customer data, you'll probably need to be SOC 2 compliant because:

• SOC 2 requirements help your company establish internal security controls – a foundation of security policies and processes that can help you expand securely.
• You build trust with your customers.

Often, service providers need a SOC 2 report because their customers require it. Customers need to know that their sensitive data is safe. The SOC 2 report can also be the key to expanding sales and moving to a larger market. He:

• Gives a signal to customers about the level of complexity in your organization;
• demonstrates your commitment to security;
• provides a powerful advantage over the competition.

Simply put, a SOC 2 audit is important for two reasons. First, getting a SOC 2 report helps your business maintain best-in-class security standards. And second, it can unlock significant growth opportunities.