A SOC 1 SSAE 18 Type 2 data center compliance checklist is essential for ensuring your facility fundamentally comprehends and understands all critical issues considered in-scope for today’s data centers and managed services providers. From providing basic “ping, power, and pipe” to essential managed O/S and application practices, data center SOC 1 SSAE 18 Type 2 assessments can vary widely, so take note of the following tips, guidelines and recommendations for reporting, provided by NDNB Accountants & Consultants.
1. SOC 1 vs. SOC 2 for Data Centers. A growing debate amongst practitioners in the world of regulatory compliance is “what’s a better fit” for data center compliance, SOC 1 SSAE 18 Type 2 reporting or SOC 2 AT 101 reporting? This debate has intensified in recent years, as both sides put forth credible merits for using either SOC 1 or SOC 2. Interestingly, many CPA firms now actually issue both SOC 1 and SOC 2 reports for data centers, with the SOC 2 report many times limited to just one or two of the actual five (5) Trust Services Principles. Whichever reporting option you choose, you should be fine (provided your SOC 1 report includes ICFR control tests), just remember to educate your clients on why you’ve chosen one over the other. If you decide to follow the trend of conducting both SOC 1 and SOC 2 reports, then you’re obviously fine.
2. Important Scope Considerations. Data centers are a business model like no other, offering a multitude of products and services for meeting customer’s needs and demands. It’s critically important to develop an audit scope that covers the minimum industry accepted baseline controls, while also providing any additional scope parameters for specialized services, such as managed hosting, cloud platforms. As for the “minimum industry accepted baseline controls”, a data center should include testing for the following operational and information security areas:
- Executive Tone | Senior Management Initiatives.
- Human Resources.
- Customer Contract and Provisioning Process (Legal, administrative and all “onboarding” processes).
- Change Management (for internal systems and customer facing environments).
- Incident Response | Customer Support Services.
- Shipping and Receiving Activities.
- Logical Security (Access rights to both internal systems and customer facing environments).
- Physical Security.
- Environmental Security.
- Backup, Replication, and Archival.
3. Managed Services. Many data centers offer much more than just traditional “ping, power, and pipe” - specifically - growing service lines include that of managed services for O/S and even application levels. Depending on customer needs, requirements, and overall expectations, SOC 1 SSAE 18 Type 2 data center compliance should include testing of these environments in regards to any number of control considerations, ranging from user access, network monitoring and performance, backups, etc. This is where’s it’s critical to communicate with all intended parties regarding the contents of such a report as expectations need to be met for comprehensive reporting.
4. SOC 1 SSAE 18 Type 2 Reporting Platform. “Flexibility” – it’s probably one of the best words to describe the SOC 1 SSAE 18 Type 2 reporting platform as it allows service organizations to essentially develop and test for controls they deem in-scope and relevant. Ultimately, this allows data centers to test a wide-array of control objectives for compliance, which provides tremendous value – according to supporters of the SSAE 18 standard for data centers.
5. SOC 2 AT 101 Reporting Platform. “Prescriptive” – without question the best term used to describe SOC 2 reporting as the Trust Services Principles (TSP) provide clear language on the relevant “criteria” to test for. Supporters of SOC 2 compliance reporting for data centers see this as comprehensive framework for testing a wide-array of technology related platforms, especially considering that there’s five (5) TSP to choose from.
6. Audit Efficiencies for SOC 1 | SOC2 and more. With an ever growing list of regulatory compliance mandates, it’s critically important to begin undertaking audit efficiencies – specifically – collecting essential evidence for overlapping areas of today’s main compliance initiatives. Hiring a proven and trusted audit firm – such as NDNB Accountants & Consultants – can make all the difference in time and money spent on.
