What is SOC 2 compliance?

SOC 2 & the 5 principles of trust

As I mentioned previously, there are five principle areas that comprise SOC 2 and together they’re called the Trust Services Criteria (TSCs). Of the five SOC 2 TSCs, only one is mandatory for compliance. Whether you need to comply with the other four depends on the underlying factors driving your SOC 2 compliance.

Security TSC

Security is the only mandatory principle in the TSCs, and as such it’s often referred to as the ‘common criteria’ (CC). There are 9 points of focus within the security TSC:

• CC1 Control Environment
• CC2 Communication and Information
• CC3 Risk Assessment
• CC4 Monitoring Activities
• CC5 Control Activities
• CC6 Logical and Physical Access Controls
• CC7 System Operations
• CC8 Change Management
• CC9 Risk Mitigation

Availability TSC

Availability means that systems and data must remain accessible to users. Organisations should explore performance monitoring to prevent downtime affecting business-as-usual, as well as have a robust disaster recovery plan in place to keep your business online.

Processing Integrity TSC

The goal of this TSC to make sure your organisation’s system and information processing remains intact. Factors to consider here include validity, accuracy and timeliness of processes to support your operations.

Confidentiality TSC

Confidentiality means that access to data should be restricted, controlled and recorded. If an incident were to take place, you would have a full audit report to prove you have maintained data confidentiality in line with the SOC 2 compliance requirements.

Privacy TSC

Privacy should live and breathe throughout your business, for example, guiding how you collect, store, process, and dispose of data. This TSC is nearly as big as the Security TSC, so it can add significant work to SOC 2 compliance.

What is the difference between SOC 1 and SOC 2?

Contrary to what the name suggests, SOC 2 is not an update of SOC 1. They are two different compliance standards, with different goals, and one or both could be right for your organisation.

SOC 2 is the more common, and robust, of the two types. If you only handle non-financial data, choose SOC 2. But if you do handle financial data, or you need Sarbanes-Oxley (SOX) compliance to become a publicly traded company, a SOC 1 audit is also needed.

SOC 1

SOC 2 Type I is a point-in-time assessment of your organisation against the relevant TSCs. As a one-off exercise, it’s cheaper and more accessible than the more in-depth Type II, but that also means it doesn’t give as thorough assurance

SOC 2

SOC 1 focuses specifically on internal controls over financial reporting to help users understand the impact controls have on the organisation’s financial statements.

4 tips for SOC 2 compliance

As with a lot of things in the information security field, the process is always far easier when you do the right groundwork. With that in mind, here are 4 top tips for SOC 2 compliance from my experience.

1. Get buy-in from senior management

   SOC 2 compliance can be a significant undertaking, so it’s a big help to get buy-in from senior management. I see that, when the top levels of an organisation are on-board with a project, it’s much easier to get the time and resources needed to see the project through.

2. Form a compliance team

   Once you have senior management buy-in, it’s a great idea to put together a compliance team to oversee the whole process. This team should include representatives from all departments involved in the SOC 2 compliance process, such as IT, security, and risk management.

3. Use a compliance management tool

   Using the right compliance management tool can help you to automate many of the tasks involved in SOC 2 compliance, such as risk assessments, control testing, and documentation. Bulletproof uses an automated compliance platform to help make SOC 2 as easy as possible for both me and the customer!

4. Get help from an export

   If SOC 2 compliance feels like an uphill struggle, don’t worry. There are always people like me out there who’ve done this before and know how to take you through this process. A trusted SOC 2 consultant can help your business through it all: scoping, implementing controls, and audit readiness. They can also help you get things like SOC 2 penetration tests, and see where efficiencies can be made with other compliance frameworks.