SOC 2 reports are in high demand today, especially when it comes to the ever-growing number of technology-oriented service organizations who are providing critical outsourcing services to other businesses. NDNB provides high-quality, competitively priced, fixed fee SOC 2 reports for both Type 1 and Type 2 reports for Dallas, Houston, and Austin, Texas businesses.
Take a page out of the NDNB playbook for Dallas, Houston, and Austin, Texas businesses, making note of the following best practices and other important criteria regarding SOC 2 reports:
SOC 1 vs. SOC 2
Make sure you that your business is performing the “correct” audit when it comes to SSAE 18 SOC 1 and SOC 2. SOC 1 assessments are for service organizations performing ICFR functions, while SOC 2 assessments are aimed at technology companies – data centers, SaaS, IaaS, PaaS, managed services, and others. There is a difference between SOC 1 and SOC 2, and deciding on which assessment generally begins with client requests and demands.
Pick the Correct Trust Services Principles
Simply known as the TSP’s, there are five (5) of them, which are the following: 1. Security. 2 Availability. 3. Processing Integrity. 4. Confidentiality. 5. Privacy. They are each unique in that they assess a specific area within a service organization’s control environment, ranging from processes and procedures to essential services and functions being performed by a company. As to which of the five (5) TSP’s to include in your SOC 2 audit – good question – and this really comes down to client needs and expectations, along with other variables, such as industry specific/market needs, etc.
Do a Readiness Assessment
The success of one’s SOC 2 audit is highly dependent upon finding – and then remediating – internal control deficiencies and weaknesses that would could result in a less than desirable audit finding. You’ve spent the time and money in finding a firm to conduct the SOC 2 audit, so make sure to include an upfront readiness assessment – a valuable exercise that identifies critical issues prior to the audit. Talk to Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706 today to learn more about important readiness considerations for your SOC 2 Type 1 or SOC 2 Type 2 audit for Dallas, Houston, and Austin, Texas businesses.
Along with performing a SOC 2 scoping & readiness assessment, another best practice every service organization should be performing is creating and keeping current an asset inventory list – a complete list of all your information systems. From network devices to servers, laptops – all of your I.T. assets should be listed and kept current in some type of formal repository, such as an MS Excel spreadsheet, or through the use of asset inventory software. Remember, you can’t protect what you don’t know you have in terms of information systems, thus know is the time to put in place a complete recording of all your I.T. assets.
Develop Formalized Processes
One of the more time-consuming aspects of becoming SOC 2 compliant is developing all the necessary information security processes and procedures required for the assessment. Change management, data backup and recovery, incident response – just to name a few – they’re all important documents needed for the audit, and they’re also essential for helping employees understand their daily roles and responsibilities.
Remediate Technical Constraints
Are your firewalls and routers not configured correctly? How about weak password complexity rules that need to be changed? Is your data backup process performing correctly, with exceptions being reported immediately? These are just a small number of examples of the many technical remediation issues businesses run into during the SOC 2 process, and why working with a proven firm such as NDNB is more important than ever. NDNB is the true leader when it comes to SOC 2 compliance for Dallas, Houston, and Austin, Texas businesses.
Speak with Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it., and receive a competitively priced fixed fee for SOC 2 reports, both Type 1 and Type 2 for Dallas, Houston, and Austin, Texas businesses, and to learn more about SOC 2 standard.