NDNB offers industry leading SOC 2 compliance audit reports for today’s growing managed security services industry, providing fixed-fees along with all essential tools and resources for documentation for ensuring an efficient audit process from beginning to end.
NDNB. North America’s SOC 2 Managed Security Services Experts
Since 2006, NDNB has performed over 100 compliance reports for managed security services companies. This included traditional data centers offering managed services to dedicated managed security services providers. We know the industry very well, have kept pace with the growing changes, and can provide auditing expertise, efficiency, and cost-savings that few firms can. Speak with Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it. to learn more about NDNB’s SOC 2 managed security services expertise. NDNB also offers comprehensive SOC 1 and SOC 2 audits for businesses using Amazon AWS, Microsoft Azure, and Google GCP.
If you're using AWS for hosting of your production environment, here's what you need to know NOW about SOC 2 audits.
4 Things to Know for SOC 2 Auditing Success for Security Services Providers
As for the managed security services, it’s important to gain a strong understanding of important SOC 2 auditing issues, thus take note of the following, provided by NDNB:
1. Assess the SOC 1 vs. SOC 2 Political Landscape: Many managed security services providers are undertaking annual SOC 1 SSAE 18 audits, and while NDNB is not stating that to be the incorrect audit, we find SOC 2 compliance to be a much better fit, and for some obvious reasons. First and foremost, SOC 2 audits are ideally situated for technology-oriented businesses – data centers and managed services providers – as the relevant Trust Services Criteria (TSP) provides prescriptive Common Criteria testing that’s highly applicable to such businesses.
Second, the SOC 2 framework represents a natural evolution of today’s service organizations – businesses that required inspection, testing, and validation of their internal control environment, which is heavily dependent upon information technology. SOC 1 SSAE 18 has its rightful place – more for companies that exhibit a true nexus to the concept known as Internal Controls over Financial Reporting (ICFR).
2. Learn about SOC 2 and the Trust Services Criteria (TSP): Going with SOC 2 – great – then it’s time to learn about the AICPA SOC framework – particularly about SOC 2 – and the Trust Services Criteria (TSP). As for the TSP’s – there are five of them, which are the following: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Remember, that each TSP has their own set of “Common Criteria” – minimum baselines controls for ensuring compliance with the respective TSP – and to no surprise – a large part of compliance with the SOC 2 standard is heavily weighted towards having comprehensive information security policies and procedures in place, and other essential documents.
3. Documentation is Critical for SOC 2 compliance for Managed Security Services: As just stated above, the need for documentation cannot be underscored enough, as processes and procedures are a large part of SOC 2 compliance. As to what types of documentation, consider the following: Access Rights, Change Management, Security and Patch Management, Data and System Backup, Incident Response, Usage Policies, Business Continuity and Disaster Recovery Planning (BCDRP), and more. The ability to develop comprehensive, in-depth, and factual policies and procedures is a big part of SOC 2 compliance for managed security services entities.
4. Remediate: It’s important to note that almost every business deciding to embark upon SOC 2 compliance in the managed security services arena will have some form of remediation to undertake. From missing documentation to weak internal controls for system access and monitoring – just to name a select few examples – remediation is part of the SOC 2 process, so keep this in mind.
It’s also another reason why managed security services providers should go through an initial SOC 2 readiness assessment for identifying gaps and weaknesses prior to the actual audit.
Fixed-Fees. Superior Service. Nationwide Coverage
Looking to become SOC 2 compliant and have questions? Contact Chris Nickell today at NDNB at 1-800-277-5415, ext. 706, or via email at This email address is being protected from spambots. You need JavaScript enabled to view it. to learn more. SOC 2 compliance “can” be an incredibly challenging and arduous exercise, so talk to the global SOC 2 experts today at NDNB. With proven industry experience for managed security services, we can help, so let’s talk. As one of North America’s leading compliance firms, we’re ready to assist you today, so give us a call and let’s talk!
