Today is a great day for abbreviations, don’t you think? Great, let’s go. The American Institute of Certified Public Accountants (AICPA) introduced the System and Organization Controls (SOC). This is the name of one of the more common compliance requirements that (tech) companies should meet today based on the Trust Services Criteria (TSC). So what is SOC 2? Are you still following?
SOC 2 is not a prescriptive list of controls, tools or processes. Rather, it cites the criteria required to maintain robust information security, allowing each company to adopt the practices and processes relevant to their own objectives and operations.
Both SOC 2 and ISO – remember that one? – are internationally recognised standards that involve an indepedent audit by a third party. The difference between ISO 27001 and SOC 2 is that SOC 2 is primarily used in the US and that it does not result in a certification, but in an attestation report.
A CPA licensed firm validates that general internal controls related to information systems are in place to secure the service you provide to your customers.
The Trust Services Criteria
The requirements are based on five TSC. These criteria are security, availability, processing integrity, confidentiality and privacy. Check them out:
- Security refers to the protection of information and systems from unauthorised access.
- Availability is whether the infrastructure, software or information is maintained and has controls for operation, monitoring, and maintenance.
- Processing integrity ensures that systems perform their functions as intended. Also, that are free from error, delay, omission and unauthorised or inadvertent manipulation.
- Confidentiality addresses the company’s ability to protect data. It should be restricted to a specified set of persons or organisations.
- Privacy criteria speaks to an organisation’s ability to safeguard personally identifiable information from unauthorised access.
Who does SOC 2 apply to?
It applies to any technology service provider or SaaS company that handles or stores customer data. Third-party vendors, other partners or support organisations that work with those organisations, should also maintain this compliance to ensure the integrity of their data systems and safeguards.
Why should they? Well, besides SOC 2 being a great rhyme word, it’s an incredible way for organisations to show customers and other stakeholders that they care about securing their data. Rigorous compliance requirements are put to the test in the on-site audit.
They namely ensure that sensitive information is being handled responsibly. This is likely to give organisations a competitive advantage. Being compliant assures others that they have the infrastructure, tools and processes to protect their information from unauthorised access.
What is also noteworthy, is that organisations (that implement the necessary controls) are less likely to suffer data breaches or violate users’ privacy. This protects them from negative effects, such as regulatory action and financial or reputational damage. Win-win, right?
To sum up the above, in practice, if you have a SOC 2 compliance, you know that your organisation maintains a high level of information security. This has a lot of advantages versus not a single disadvantage, which is a great way to close this case. woohoo!
