SOC 2 vs PCI Compliance – Introduction and Overview

As auditors, we’re often asked to provide a comprehensive overview regarding SOC 2 vs PCI compliance. More specifically, businesses that have to undertake both SOC 2 audits and PCI DSS assessments on an annual basis want to learn more about the respective frameworks, what overlaps and mapping of controls exist, pricing, and much more. Well, let’s get started and take a deep dive into SOC 2 vs PCI compliance, compliments of NDNB, one of North America’s leading providers of high-quality, fixed-fee audit services from coast to coast.

An Introduction to SOC 2

System and Organization Controls (SOC) 2 is a comprehensive reporting framework put forth by the American Institute of Certified Public Accountants (AICPA) for which independent, third-party auditors, such as a CPA and/or CPA firm, perform an assessment and subsequent testing of controls relating to the Trust Services Criteria (TSP) of Security, Availability, Processing Integrity, Confidentiality and/or Privacy.

SOC 2 reports are intended to meet the needs of a broad range of users requiring detailed and comprehensive information and assurance about the controls at a service organization relevant to security, availability, and processing integrity of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems. As such, SOC 2 reports play a vital role regarding the oversight of the organization, vendor management programs, corporate governance and risk management processes, regulatory compliance oversight, and more.

An Introduction to PCI DSS

The Payment Card Industry Data Security Standards (PCI DSS) is a comprehensive framework developed and endorsed by the major card brands that emphasize a wide-range of security best practices for protecting credit card information. Since it’s launch, the PCI DSS framework has continuously evolved to keep pace with changes in information security. There are twelve (12) PCI DSS “Requirements”, each of them dedicated to a specific topic relating to information security and the protection of cardholder data. In total, the overall PCI DSS framework (which is currently on version 3.2.1) has approximately 300 tests of controls for validating compliance.

SOC 2 vs PCI DSS Compliance – 7 Things You need to Know

1. PCI DSS Compliance has a bigger FOCUS on Information Security. The Payment Card Industry Data Security Standards (PCI DSS) has without question a larger focus on information security. With twelve (12) requirements and approximately 300 + plus tests for validating compliance, PCI DSS is heavy on InfoSec. Heavier and larger than SOC 2? Yes, without question, and that’s because the PCI DSS framework is prescriptive in that the InfoSec controls are required. As for SOC 2 compliance, there’s much for flexibility, which means auditors can leave quite a bit of InfoSec controls out of scope.

2. SOC 2 Compliance has a bigger FOCUS on internal control processes and procedures. While the PCI DSS framework is larger in terms of InfoSec scope, SOC 2 compliance is very big on documented and formalized processes and procedures. This is important to note because SOC 2 compliance will require service organizations to develop a large number of operational policies and procedures – a time-consuming endeavor indeed. It’s also a big reason why NDNB offers complimentary SOC 2 policy templates to all our valued clients. Call and speak with Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today to learn more about PCI vs SOC 2.

3. Mapping between SOC 2 and PCI DSS is now more challenging than before. This is because the SOC 2 framework now puts greater emphasis on internal processes and procedures, which is noticeably different than the previous AICPA SOC 2 framework. Because of this, there’s simply no one-for-one match regarding audit requirements between SOC 2 and PCI. You’re going to have to work a litter hard these days.

4. Both frameworks require a heavy dose of policies and procedures. Documentation in the form of information security policies and procedures is one of the most exhaustive, time-consuming activities when it comes to SOC 2 and PCI DSS compliance. Both frameworks assess a wide-range of InfoSec controls, such as access rights, change management, incident response, and much more. Because of this, auditors well be on the lookout – and will be requesting – your information security polices and procedures, so be ready.

Along with policies and procedures, both SOC 2 and PCI DSS compliance require an annual risk assessment to be performed, annual security awareness training to be undertaken, along with performing regularly scheduled vulnerability scans.

NDNB offers a comprehensive SOC 2 Policy Packet containing hundreds of pages of expertly written InfoSec policies and procedures, and they’re complimentary to all of our valued clients throughout North America. Call and speak with Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today to learn more about PCI vs SOC 2.

5. Operational Similarities. Even with differences when it comes to SOC 2 and PCI DSS compliance, there are a number of operational similarities. When using the term “operational”, it essentially means undertaking a number of essential measures, specifically, the following: (1). Perform regularly scheduled internal and external vulnerability scans. (2). Implement annual security awareness training for all in-scope employees. (2). Perform an annual risk assessment of the in-scope business environment. (4). Have in place – and test – your incident response plan as necessary.

The above measures are much more than just writing policies and procedures, they require businesses to actually roll up their sleeves and perform a number of “operational” functions. NDNB offers templates and other supporting documents for helping businesses meet these many operational reporting requirements for both SOC 2 and PCI DSS compliance. Call and speak with Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today to learn more about PCI vs SOC 2.

6. Here’s where there are similarities.  Both PCI DSS compliance and SOC 2 assessments require a healthy dose of audit evidence to auditors. For example, be expected to provide the following deliverables:

• Information security policies and procedures
• Screenshot of system settings
• Log reports and log files
• Signed memos

7. NDNB Can assist. We perform both SOC 2 audits and PCI DSS assessment for all of our clients, so contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today.