Data breaches and hacks occur regularly today, so it’s no wonder information security is now a priority. A SOC 2 report is a general-purpose document showing that a particular service is securely provided to user organizations and stakeholders. There are also criteria related to Availability, Confidentiality, Processing Integrity, and Privacy that can be included in a SOC 2.
We will examine some common questions regarding SOC 2 reports in this article. Even though some of the terminologies may be confusing at first, achieving SOC 2 compliance does not need to be difficult. Let’s take a closer look at soc 2 compliance reports and examinations. Let’s get started!
SOC 2 Certification – What Is It?
A SOC 2 isn’t a certification, but it is often made out to be one. An audit firm that issues a clean report opinion agrees with management’s assertions about the controls design (Type I and Type II) and operation (Type II only). The term “pass” is sometimes used to describe a clean report. In many cases, CPA firms agree with management’s assertions, and the opinions are positive. A CPA firm may not agree with management’s assertions and provide a qualified or adverse opinion. Please see our previous blog post about qualified opinions. It is common to call a SOC 2 a certification, though it is technically an attestation report.
SOC 2 Compliance: What is it? The Trust Services Criteria (TSC)
SOC 2 reports cover the Trust Services Criteria (TSC) as part of their scope. However, not all TSCs are required. Only the common criteria (also called the Security TSC) are required. Additional TSCs may be added to a report to address clients’ common risk-related questions or address the risks facing the company and its unique service offering. A SOC 2 report may include availability criteria as well as security criteria, for example, if healthcare data availability is vital to a service offering.
Prospective clients have said that they wanted all of the TSCs included in their SOC 2 report in order to ensure that it was as strong as possible. Although the logic makes sense, not all TSCs may apply to a particular client’s service. If your company doesn’t process transactions, processing integrity is not relevant.
Some firms have included TSCs in reports when they aren’t applicable and then explained why they aren’t applicable. This is not recommended. Choose criteria that are applicable to your services and answer the risks-related questions that you hear most from your clients and prospects.
Criteria for Privacy and Confidentiality
There are a variety of privacy laws in place in various parts of the world. GDPR and CCPA, for example, apply to all citizens in a particular area and grant protections to all citizens in that area. The United States currently follows a sectoral approach to privacy, which means that laws apply to specific industries or types of data rather than a uniform approach.
The AICPA’s privacy criteria apply only to companies dealing directly with data subjects and collecting personal information as part of their services.
Typically, email and contacts collected by companies for marketing purposes aren’t enough to warrant the privacy criteria’s application. Many times, PII or sensitive data is entrusted to a company by another company that is actually collecting the data. As per the AICPA, this is considered confidential (B2B data sharing). It may be relevant to use privacy criteria if your company collects data directly from consumers. Processing integrity is unique to each company if it is relevant since no two companies process their transactions exactly the same way.
