SOC2 Compliance Services
SOC2 Certification
User entities and organizations want reporting that provides assurance on controls over operations and compliance, rather than just on controls over financial reporting. The AICPA created a framework to enable a broader type of third party attestation reporting on controls at service organizations beyond merely financial reporting. This framework is the Service Organization Control (SOC) reporting framework. The SOC framework has 3 different reporting options: SOC1, SOC2, and SOC3.
Some Facts
SOC 2 reports are appropriate for engagements to report on controls at a service organization related to the Trust Service Principles, defined by the AICPA in TSP Section 100. The Trust Service Principles are:
- Security
- Availability
- Processing Integrity
- Confidentiality
- Privacy
SOC 2 engagements are performed in accordance with AT section 101, Attestation Engagements, using guidance in the AICPA Guide, Reporting on Controls at the Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy.
SOC2 Type I Report
SOC 2 Type 1 report delivers a description of your organization?s system and its ability to meet the relevant criteria set by the Trust Services Criteria at a specific date in time. This is used to endorse that the necessary controls are in place on the particular day of the audit. Type 1 report just provides a report of procedures / controls an organization has put in place as of a point in time.
SOC 2 Type 1 report details the suitability of the design controls to the service organization?s system. It details the system at a point in time particularly its scope, the management of the organization describing the system, and the controls in place. Key to this report is its ?as of? date meaning it deals with the specifics of a system within a particular point in time. The auditor will base his or her report on the description of the controls and review of documentation around these controls. SOC 2 Type 1 report is particularly helpful to service companies as it can make them more competitive. It gives potential customers the assurance that a service organization has passed the said auditing procedure, and that their data is safe if they work with the SOC 2-compliant company.
There is an increased customer demand for SOC 2 Type 1 report as cybercrime cases mount. Companies now want to work with vendors who can prove that they can manage or handle sensitive data well. This report is now considered a necessity for companies handling customer data like healthcare firms and financial institutions
