By Charles on Wednesday, 30 January 2019
Category: SOC Reports

SOC 2 Type 1 Guide for SOC Reports

Looking for a SOC 2 Type 1 guide, then welcome to socreports.com, the most in-depth website dedicated to the SOC 2 standard. Developed by NDNB – North America’s leading provider of SOC 2 assessments, socreports.com will answer all your SOC 2 questions, essentially becoming your SOC 2 Type 1 guide. Moreover, NDNB’s SOC 2 Type 1 guide information is without question the most informative, up-to-date, and easy-to-read documentation found anywhere on the Internet today.

If your business is interested in seeking annual SOC 2 compliance – or you’re being requested to perform such services by a client or notable prospect – here’s what you need to know:

1. Welcome to the World of Regulatory Compliance: Today’s business world is full of challenges and complexities, and now a new and ever-growing mandates sits high on the list for many businesses; regulatory compliance. With an ever-changing digital world and a threat landscape that seems to be growing larger each year, companies are being required to perform a host of annual security and operational audits, such as SSAE 18 SOC 1 and SOC 2 compliance. SOC 2, put forth by the AICPA, is essentially tailored towards technology companies – the likes of data centers, SaaS vendors, and more – so if that’s you, then expect to be summoned for annual SOC 2 compliance.

2. Understand the Differences between SSAE 18 SOC 1 and SOC 2: Call it the SOC 1 vs. SOC 2 debate, a debate that continues to this day as both businesses and CPA firms argue the merits of each assessment and which one is the better fit for organizations being hit with regulatory compliance requests. Just remember this; SSAE 18 SOC 1 audits are for service organizations performing services that can impact their client’s financials, while SOC 2 assessments are performed on businesses that are largely in the technology space. There’s quite a bit of chatter as to what’s the “correct” audit to perform, so contact Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. today to learn more about SOC 1 vs. SOC 2.

3. Beginning with a Readiness Assessment is Essential: What’s the very best – and first step – any service organization should take for ensuring the long-term success of a SOC 2 assessment? It begins by performing a SOC 2 scoping & readiness assessment; the critical activities that assess a service organization’s internal controls relating to policies, procedures, and processes. Look, no company – and we mean no company – has a picture-perfect internal control environment, and it’s why a SOC 2 scoping & readiness assessment is absolutely critical. It’s not just another cost for the engagement, rather, a brief, yet highly essential activity for helping determine your current control environment.

4. Policy Remediation is a Must: One of the biggest – and most time-consuming – aspects of SOC 2 compliance is developing all the necessary and mandated information security and operational specific policies and procedures that need to be in place. Nobody really wants to spend endless hours authoring mundane policy documents – we more than understand – and it’s why NDNB offers a comprehensive SOC 2 Policy Packet to all of our trusted clients seeking to assess against the SOC 2 framework. If you want to save thousands of dollars and put in place industry leading information security policies and procedures, then consider working with NDNB for all your SOC 2 needs.

5. Technical Remediation is also critical: Policies and procedures are a large part of becoming SOC 2 compliant, as just discussed, but so are the various technical and security mandates that must be in place when assessed against the SOC 2 “common criteria” framework. Because of this, businesses often find notable gaps within their I.T. infrastructure – from weak passwords to incorrectly configured information systems, and more – thus requiring remediation, which can be challenging. NDNB has numerous hardening checklists and best practices forms we offer to our clients for helping with all necessary remediation initiatives – a cost-savings which is hard to ignore!

6. Determine Downstream Third-Party Providers: Do you work with other entities that could impact your internal controls – organizations that you depend upon for critical businesses services? If so, such organizations – known as subservice organizations – may possibly be brought into the scope of your SOC 2 audit. Many times, however, they may have their own SOC 2 audit report already, but if not, additional testing procedures may have to be performed by your auditors. Determining scope is critically important for SOC 2 compliance, and it’s just another reason why beginning with a SOC 2 scoping & readiness assessment is highly essential indeed.

7. Continuous Monitoring is Essential: You still have a specific mandate to assess, monitor, and safeguard your internal controls long after an annual SOC 2 audit assessment has been completed. Sure, you’ve got annual SOC 2 compliance under your belt – so congratulations – but real monitoring takes place when the auditors have packed their bags and left. You need a system and process for ensuring such internal activities are being performed, and NDNB can assist in developing a comprehensive “continuous monitoring” platform for your business. Ensuring the continued safety and security of an organization’s assets – and your customer’s assets – requires implementation of “continuous monitoring”.

8. Using AWS for Hosting? Here's What You Need to Know about Performing a SOC 2 Audit when Using AWS:

Additional points worth noting about NDNB’s industry leading SOC 2 compliance services are the following:

Speak with Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it., and receive a competitively priced fixed fee for SOC 2 Type 1 audits.