System and Organization Controls (SOC) 2 is a comprehensive reporting framework put forth by the American Institute of Certified Public Accountants (AICPA) in which independent, third-party auditors (i.e., CPA’s) for an assessment and subsequent testing of controls relating to the Trust Services Criteria (TSC) of Security, Availability, Processing Integrity, Confidentiality or Privacy.
The Goal of SOC 2 Audits
SOC 2 reports are thus intended to meet the needs of a broad range of users requiring detailed information and assurance about the controls at a service organization relevant to security, availability, and processing integrity of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems. As such, SOC 2 reports play a vital regarding the oversight of the organization, vendor management programs, corporate governance and risk management processes, regulatory compliance oversight, and more.
Understanding the SOC 2 Trust Services Criteria (TSP)
Regarding the Trust Services Criteria (TSP), please note the following: The TSP are control criteria for use in attestation or consulting engagements to evaluate and report on controls over information and systems (a) across an entire entity; (b) at a subsidiary, division, or operating unit level; (c) within a function relevant to the entity's operational, reporting, or compliance objectives; or (d) for a particular type of information used by the entity. The TSP are classified into the following categories:
- Security. Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
- Availability. Information and systems are available for operation and use to meet the entity’s objectives.
- Processing integrity. System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
- Confidentiality. Information designated as confidential is protected to meet the entity’s objectives.
- Privacy. Personal information is collected, used, retained, disclosed, and disposed to meet the entity’s objectives.
SOC 2 Type 1 vs. SOC 2 Type 2 Reports
Additionally, similar to a SOC 1 report, there are two types of reports: (1). SOC 2 Type 1 report on management’s description of a service organization’s system and the suitability of the design of controls. Use of these reports are restricted. (2). SOC 2 Type 2 report on management’s description of a service organization’s system and the suitability of the design and operating effectiveness of controls.
NDNB. Your SOC 2 Compliance Experts for North America
SOC 2 compliance can be an incredibly time-consuming and taxing proposition, and it’s why finding the right firm is for helping you get from A to B is now more important than ever. NDNB is that firm, a company with years of experience in getting compliance right the first time, so contact us today to learn more about our solutions and services.
As to what the future holds – more compliance, no question about it – as Congress and industry regulators continue to push for stronger and more stringent financial and data privacy laws. From protecting personal consumer information to safeguarding sensitive financial data – and more – regulatory compliance is alive and well and not going anywhere.
NDNB also offers comprehensive SOC 1 and SOC 2 audits for businesses using Amazon AWS, Microsoft Azure, and Google GCP.
Using AWS for Hosting? Here's What You Need to Know about Performing a SOC 2 Audit when Using AWS
SOC 1, SOC 2, and SOC 3 Compliance Experts
Are your compliance needs causing you unnecessary stress and fatigue – they shouldn’t – so contact the experts today at NDNB and speak with a highly experienced firm with years of experience helping businesses with the likes of SOC 1, SOC 2, and SOC 3 compliance. Call and speak with an authorized NDNB representative today at 1-800-277-5415, ext. 706 today.
