Call the proven and trusted SOC 2 framework experts today at NDNB as we provide incredibly comprehensive, cost-effective, “fixed-fee” engagements for the SOC 2 framework. From coast to coast, NDNB has been offering high-quality, industry leading compliance services and solutions for not only SOC 2 audits, but for many of today’s regulations, such as SOC 1 SSAE 18, SOC 2, SOC 3, EI3PA, ACH Audits, MERS compliance, internal audits, and more

SOC 2 Framework and 4 Important Points to Know

The SOC 2 framework, which is effectively part of the AICPA Service Organization Control (SOC) reporting platform, represents a true willingness to develop and implement an assessment methodology geared towards technology oriented service organizations. With that said, the following four (4) points are critical to note regarding SOC 2:

1. Scope is Critical: Ever heard of the term “scope creep”, let’s just say it’s not something you want to happen during a SOC 2 assessment, which is why properly scoping the audit at the very beginning is highly critical. With that said, there are two (2) important aspects to scoping – the first being identifying the business process to assess, and the second being which of the five (5) Trust Services Principles & Criteria (TSP/C) are to be included within the actual scope of the assessment. Sounds rather straightforward – and it is when working with a high-quality, well-respected CPA firm – but diving into SOC 2 audits with little or no insight regarding scope is not recommended. Here are some helpful tips for assessing SOC 2 scope:

First, determine what the actual business process is that will be included for a SOC 2 assessment, is it everything the organization does or just a specific business unit or division? Second, identify which of the five (5) Trust Services Principles & Criteria (TSP/C) are to be used for reporting, for which you should confer with a well-qualified CPA firm on this. Nobody wants the awful “scope creep” dilemma to come calling, so plan accordingly and speak to knowledgeable professionals today.

Second, documentation is essential: In today’s world of regulatory compliance, documentation is often the key to audit success – and failure – thus the importance of information security documents cannot be overlooked for SOC 2 compliance. In fact, whichever of the five (5) Trust Services Principles & Criteria (TSP/C) you choose for the audit (one, a few, or all of them), they all require documentation to be in place - it is just that simple.

Appropriately configuring firewall rules, implementing complex password policies, and instituting formalized change control practices, and more – they’re all important, no question about it – but don’t forget that accompanying documentation for such initiatives is incredibly essential for SOC 2 audits. Remember, auditors are always on the lookout for information security documents, so keep that in mind.

2. Annual Compliance is often mandatory: Call it the “new norm” in the world we all live in regarding regulatory compliance for any business providing critical outsourcing services to other businesses. In today’s world of cost-savings and business efficiencies, outsourcing is happening everywhere –and for good reason – but just remember that heavy compliance mandates come along with it. From cloud computing providers to data centers – and more – SOC 2 compliance is here to stay, so get prepared for annual audit commitments to your customers.

3. Mapping of Audit Controls is Crucial: In today’s world of growing regulatory compliance mandates, a large number of companies are being faced with multiple compliance audits – it’s just the new norm of business – and if that’s you, then it’s time to talk to NDNB about our compliance mapping services that help businesses put in place effective controls and policy documents for all major regulations. A large number of core information security and operational frameworks, procedures, and processes are very similar, thus implementing controls and developing documentation that speaks to such efficiencies is critical. We can assist – it all begins by contacting Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706, or emailing him at This email address is being protected from spambots. You need JavaScript enabled to view it., and receive a competitively priced fixed fee for SOC 2 audit reports.

4. Where to begin? With a SOC 2 scoping & readiness assessment from NDNB, that’s where. Performed by licensed and certified auditors, our SOC 2 scoping & readiness assessment engagements are an incredibly helpful tool for evaluating your organization. Learn more about the SOC 2 framework by visiting socreports.com.