Compliance White Papers

Taking the hassle out of staying compliant

Get A Fixed Fee Quote Today Request a Free Quote

Is your business in Southern California and you need a SOC 2 Type 1 or a SOC 2 Type 2 audit, then turn to the Golden State experts today at NDA Accountants & Consultants, LLP (NDNB). For more than 10 years, NDNB Has been helping businesses up and down the California coast in providing high-quality, competitively priced, fixed-fee audit and attest services, so call and speak with Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, to learn more, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it..

SOC 2 Type 1 & Type 2 Audit Reports | Southern California | Call NDNB Today

Businesses (i.e., service organizations) today in Southern California having a credible nexus to information technology – such as data centers, Software as a Service (SaaS) entities, managed service providers, and more – are being asked to become SOC 2 compliant, which can be challenging. The key to SOC 2 success is understanding its intent – and finally – putting in place a flexible and sustainable roadmap towards SOC 2 Type 1 and/or SOC 2 Type 2 compliance.

NBD has years of experience working with Southern California service organizations in regards to regulatory compliance audits – specifically that of SOC 1 SSAE 18 and SOC 2 – and provides an efficient and flexible roadmap that simply works. From an initial readiness assessment to the final issuance of a service auditor’s report, NDNB offers an incredibly easy-to-follow lock step process from beginning to end.

SOC 2 Type 1 & Type 2 Audit Reports | Southern California

Becoming compliant with the SOC 2 reporting standards put forth by the American Institute of Certified Public Accountants (AICPA) can be challenging, and it’s why Southern California businesses turn to the experts at NDNB, and so should you. Contact Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, to learn more, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it..  It’s also important to remember the differences between SOC 1 vs. SOC 2 for ensuring the correct AICPA Service Organization Report (SOC) is being used.

Generally speaking, SOC 1 SSAE 18 reporting focuses on the financial reporting impact that a service organization’s processes can have on their clients, while SOC 2 reporting is for technology oriented service organizations. The concept – known as “ICFR” – stands for Internal Controls over Financial Reporting, which requires service organizations to fully understand and assess such criteria when undertaking a SOC 1 SSAE 18 Type 1 and/or Type 2 audit. As for SOC 2, companies such as data centers, SaaS entities, managed service providers – and more – are typical candidates for this type of assessment.

SOC 2 Type 1 & Type 2 Audit Reports | Southern California

To learn more about NDNB’s highly proven, scalable, and cost-effective SOC 2 audits – along with SOC 1 SSAE 18 compliance solutions – contact Christopher Nickell at This email address is being protected from spambots. You need JavaScript enabled to view it. or by calling him directly at 1-800-277-5415, ext. 706. Regulatory compliance is here to stay – that we all now – so talk to a firm in Southern California with years of experience, and that’s NDNB. Outsourcing is the new business model being adopted by seemingly everyone and everywhere – and that’s perfectly acceptable – just remember, however, that large regulatory compliance mandates loom for Southern California businesses offering such services. For competitively priced fixed fees, contact the SOC 2 experts today at NDNB.

The SOC 2 Privacy Principle is one (1) of the five (5) Trust Services Principles (TSP) put forth by the American Institute of Certified Public Accountants (AICPA) within the SOC 2 reporting framework. In today’s growing world of regulatory compliance, much emphasis is now being placed on the “Privacy” principle, for which the AICPA defines as the principle that “…addresses the system’s collection, use, retention, disclosure, and disposal of personal information in conformity with the commitments in the entity’s privacy notice and with criteria set forth in generally accepted privacy principles (GAPP) issued by the AICPA and Canadian Institute of Chartered Accountants…”.
Source: http://www.aicpa.org/

Many service organizations think that their actual privacy policy on one’s website suffices for such a mandate for the actual SOC 2 Privacy Principle. This is generally not true. Instead, the Privacy Principle should be looked upon as a collection of processes, procedures, legal documents, and other best practices for ensuring the safety and security of highly sensitive and confidential consumer data. Often known as Personally Identifiable Information (PII).

Therefore, meeting the rigors of the AICPA Privacy Principle should generally consist of the following:

SOC 2 compliance in Canada is growing larger each year as more and more Canadian companies are being asked for assurances of their internal control environments regarding services they provide to customers. From data centers to Software as a Service (SaaS) entities – and more – SOC 2 compliance in Canada is here to stay. With that said, take note of the following five (5) important elements regarding SOC 2, ranging from its background to pricing, and more.

1. Learn about the five (5) Trust Services Principles (TSP). The SOC 2 trust principles consist of the following:

  • The security of a service organization's system.
  • The availability of a service organization's system.
  • The processing integrity of a service organization's system.
  • The confidentiality of the information that the service organization's system processes or maintains for user entities.
  • The privacy of personal information that the service organization collects, uses, retains, discloses, and disposes of for user entities.

2. Changes are in place for SOC 2 compliance for Canada businesses. The SOC 2 Trust Principles are part of the AICPA Service Organization Control (SOC) framework, which allows for three (3) reporting options – SOC 1, SOC 2, and SOC 3. SOC 2 has quickly become the global “go to” assessment standard for technology service organizations in Canada, data centers, SaaS entities, software development organizations, and many other businesses, are an excellent for the SOC 2 framework.

And if you are curious as to the SOC 1 vs. SOC 2 debate, SOC 1 reporting “should” be used primarily for reporting on service organizations exhibiting a close affiliation with the concept known as “Internal Controls over Financial Reporting (ICFR). Think banks, trust departments, actuaries – companies that truly have financial implications within their internal controls. We at NDNB preface “should” because many service organizations are still being issued SOC 1 reports when they’re really a candidate for SOC 2 reporting. However, this is changing as more and more companies are becoming much more educated on the entire AICPA Service Organization Control (SOC) framework, thus starting to realize the true benefits of SOC 2 reporting over SOC 1 reporting.

Now, back to SOC 2! For reporting periods on or after December 15, 2014, SOC 2 will consist of the following general areas:

  • Organization and management
  • Communications
  • Risk management and implementation of controls
  • Monitoring of controls
  • Logical and physical access controls
  • System operations, and
  • Change management

3. Operational and Technical Changes. One of the biggest – if not often the biggest – challenge for SOC 2 compliance is that of putting in place operational specific processes and procedures being requested by auditors. It means spending untold numbers of hours confirming such measures are in place and formalized such initiatives for ensuring compliance with the SOC 2 mandates. Companies are very good at what they do – or they wouldn’t be in business – but unfortunately also loathe the formality of compliance. Let NDNB help in formalizing your processes and procedures when it comes to SOC 2 compliance for Canada.

4. Defining Scope. Remember that there are five (5) Trust Services Principles – (1). Security. (2). Availability. (3). Processing Integrity. (4). Confidentiality, and (5). Privacy. Thus, as a service organization, you’ll need to decide which of the five – one, a few, or all of them – are to be included within the scope of your SOC 2 assessment. How to decide – by carefully understanding your specific business platform and balancing that with the reporting needs of intended users of the report. SOC 2 reports for Canadian Software as a Service (SaaS) entities, for example, most certainly include the TSP’s of “security” and “availability”, while a SOC 2 assessment for a healthcare company should assess against the “confidentiality” and “privacy” Trust Service Principles (TSP). Again, scoping and choosing the correct TSP’s are a big part of SOC 2 compliance for Canadian companies.

5. It’s an Annual Commitment. If you’re being asked to become SOC 2 compliance by a customer, regulatory body, or any other significant entity, then welcome to the world of regulatory compliance. More specifically, get used to the SOC 2 compliance mandate on an annual basis, which means you should seek out a qualified and reputable CPA firm who can provide a 3 or 5 year fixed fee proposal. From Vancouver to St. Catharines – and many other locations throughout Canada – NDNB has a well-established track record of providing high-quality, fixed fee regulatory compliance audits, so contact us today.  

Call Christopher Nickell, CPA, today at 1-800-277-5415, ext. 706, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it., to learn more about NDNB SOC 2 Canada service, along with our numerous other regulatory compliance offerings, such as SOC 1 and SOC 3 assessments, PCI DSS compliance, HIPAA compliance, and much more.

SOC 2 Type 2 reporting & compliance is a growing trend in today’s world of never ending regulations and industry specific mandates. With the pronouncement of the Service Organization Control (SOC) framework, which consists of SOC 1, SOC 2, and SOC 3 reporting, the SOC 2 standard has become the de facto reporting platform for technology oriented organizations, and for good reason. From managed services providers to data analytics entities, managed service providers – just to name a select few – SOC 2 Type 2 reporting & compliance is here to stay. With that said, it’s important to gain a strong understanding of the following critical elements regarding SOC 2 Type 2 reporting & compliance.

The SOC 2 trust principles are criteria based provisions consisting of what’s essentially known as the Trust Services Principles (TSP), which are the following:

  • The security of a service organization's system.
  • The availability of a service organization's system.
  • The processing integrity of a service organization's system.
  • The confidentiality of the information that the service organization's system processes or maintains for user entities.
  • The privacy of personal information that the service organization collects, uses, retains, discloses, and disposes of for user entities.

Furthermore, SOC 2 reporting & compliance is technically part of the AICPA Service Organization Control (SOC) framework, which allows for three (3) reporting options – SOC 1, SOC 2, and SOC 3. Please also note that the SOC 2 Trust Principles, which have been revised for reporting periods on or after December 15, 2014, will consist of the following seven areas:

The SOC 2 standard, which is part of the AICPA Service Organization Control (SOC) reporting framework for service organizations regarding one's internal control environment, has become an increasingly well-known audit assessment. Launched to help replace the aging and often misused SAS 70 auditing standard, the SOC 2 standard is now the de facto auditing framework for technology oriented service organizations - data centers, managed services providers, software development entities, and many others. With that said, here's what you need to know about the SOC 2 standard, provided by NDNB Accountants & Consultants, a nationally recognized IR CPA firm offering fixed fee engagements.

1. SOC Framework. The SOC 2 standard is a subset of the AICPA Service Organization Control (SOC) framework, a consortium of assessments that consists of SOC 1, SOC 2, and SOC 3. It was a move by the AICPA to fundamentally restructure and change the way service organizations undertake auditing of their internal control environments. Gone is a one-size fits all approach (i.e., SAS 70), as service organizations now have three (3) options to choose from.

2. SOC 2 Standard and Technology. The vast majority of organizations undertaking SOC 2 assessments are technology oriented, those just discussed above (data centers, etc.) and that's because the SOC 2 standard – and it's supporting framework – is designed for such organizations. The SOC 2 Standard utilizes what's known as the "Trust Services Principles" for assessing a service organization, and these TSP's are heavily weighted toward information security best practices.

The SOC 2 trust principles are criteria based provisions consisting of what’s technically known as the Trust Services Principles (TSP), which consist of the following:

  • The security of a service organization's system.
  • The availability of a service organization's system.
  • The processing integrity of a service organization's system.
  • The confidentiality of the information that the service organization's system processes or maintains for user entities.
  • The privacy of personal information that the service organization collects, uses, retains, discloses, and disposes of for user entities.

Additionally, the SOC 2 Trust Principles are part of the AICPA Service Organization Control (SOC) framework, which allows for three (3) reporting options – SOC 1, SOC 2, and SOC 3. SOC 2 has quickly become the de facto assessment standard for technology oriented service organizations – and rightfully so – as data centers, SaaS entities, software development organizations, and many other businesses, are an ideal fit for the SOC 2 framework. The SOC 2 Trust Principles, which have been revised for reporting periods on or after December 15, 2014, now are structured in the following manner (7 general areas):

Since 2006, NDNB has been setting the standard for security & compliance regulations