{"id":12466,"date":"2020-06-30T10:00:00","date_gmt":"2020-06-30T14:00:00","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12466"},"modified":"2024-10-18T10:58:48","modified_gmt":"2024-10-18T14:58:48","slug":"what-is-soc2-compliance-how-does-it-affect-your-business","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/what-is-soc2-compliance-how-does-it-affect-your-business\/","title":{"rendered":"What Is SOC2 Compliance & How Does It Affect Your Business?"},"content":{"rendered":"\n

How SOC 2 reports can help cloud service providers stand out from the competition (and make your customers feel more confident in your ability to protect their data)<\/h2>\n\n\n
\n
\"SOC
Image source: CloudTweaks<\/a><\/figcaption><\/figure>\n<\/div>\n\n\n

While we can all appreciate the humor of this comic, it\u2019s scary how many organizations have this type of mindset when it comes to the security, privacy, and confidentiality of their cloud-stored data. This is where SOC 2 compliance audits and reports really come in handy.<\/p>\n\n\n\n

But what is SOC 2 compliance? SOC2 compliance is an essential component of information security for many businesses and organizations. This rings especially true for those that are third-party service providers such as cloud storage, web hosting, and software-as-a-service (SaaS) companies\u2026 Or, really, any organization that stores its customer data in the cloud. As you can imagine, that expands the list a lot.<\/p>\n\n\n\n

Basically, SOC 2 audits and reports help service providers show that the privacy, confidentiality and integrity of the data they handle \u2014 meaning their customers\u2019 or their customers\u2019 users\u2019 data \u2014 is a priority<\/strong>. While it\u2019s not saying that they\u2019re 100% secure as organizations as a whole, it shows that they\u2019re ahead of their competitors who lack these reports. This helps their customers understand that those vendors are doing what they should be doing to keep said data secure in the cloud.<\/p>\n\n\n\n

So, when we talk about SOC2 compliance, what exactly does that mean? And why is having an SOC 2 report so important to your customers? And who actually performs these examinations and creates the reports that organizations worldwide trust?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

What Is SOC 2? A Look at What SOC2 Compliance Entails\u2026<\/h2>\n\n\n\n

Feeling a little lost? You’re not alone (hence why we wrote this article). In a nutshell, SOC2 (commonly pronounced \u201csock 2\u201d) stands for the second of three System and Organization Controls (SOC)<\/a> audits and reports that are integral to information security. The SOCs are a set of compliance standards that were developed by the American Institute of CPAs (AICPA), a member network of more than 430,000 CPAs around the world.<\/p>\n\n\n\n

SOC audits are designed to examine the policies, procedures, and internal controls of an organizations. Testing and reporting on these controls are important because they impact the security, privacy, and confidentiality of an entity\u2019s sensitive data. Every audit is conducted in accordance with the AIPCA audit guide<\/a> and Attestation Standards Section 101<\/a> more commonly known as AT Section 101).<\/p>\n\n\n\n

SOC audits are what draws the lines that service providers need to color within regarding data privacy, security, and integrity. It\u2019s about showing customers and potential customers that you know what you\u2019re doing and are taking the appropriate steps to ensure their data is secure with you.<\/p>\n\n\n\n

The Three Types of SOC Reports<\/h3>\n\n\n\n

So, what are the three types of SOC reporting options for service organizations? They include:<\/p>\n\n\n\n

    \n
  1. SOC 1<\/strong><\/a> \u2014This is designed for reporting on the processes and controls that influence an organization\u2019s internal control over financial reporting <\/strong>(ICFR). Essentially, the choices you make as a service organization may affect the financial reporting of your users\u2019 organizations.<\/li>\n\n\n\n
  2. SOC 2<\/strong><\/a> <\/strong>\u2014 This report is designed for service organizations and reports on non-financial reporting<\/strong> controls and focuses on five key trust services criteria <\/strong>(formerly called trust services principles), or TSCs as they\u2019re more commonly known (which we\u2019ll discuss more in depth momentarily). Basically, the goal here is to help outline the standards that are necessary to keep sensitive data private and secure while it\u2019s in transit or at rest.<\/li>\n\n\n\n
  3. SOC 3<\/a><\/strong> \u2014 The third type of SOC report is akin to the second in terms of the reporting criteria \u2013 the difference between the two boils down to how the info is reported. SOC 2 is tailored for specific organizations, whereas SOC 3 reports are more applicable for general audiences (the public).<\/strong><\/li>\n<\/ol>\n\n\n\n

    There are also technically SOC reports for cybersecurity and the supply chain as well, but we won\u2019t get into all of that today. Just know that there are several key differences<\/a> between an SOC for cybersecurity report (which, essentially, is an examination of an organization\u2019s cybersecurity risk management program) and an SOC 2 engagement report. KirkPatrickPrice reports<\/a> that those differences relate to subject matter, purpose and use, audience, and report types.<\/p>\n\n\n\n

    There are specific standards that apply to all types of SOC reports \u2014 these are known as the Statement on Standards for Attestation Engagements (SSAE)<\/a>, which is currently at version No. 18. This auditing standard is basically the successor of the now-deprecated SSAE No. 16 auditing standard, which used to only apply to SOC 1 reports.<\/p>\n\n\n\n

    How SOC 2 and SOC 1 Differ, and Why SOC 2 Compliance Matters to Your Organization<\/h3>\n\n\n\n

    The SOC 2 standards, in particular, focus on the non-financial reporting on the internal controls and systems that you can implement to protect the confidentiality and privacy of data that\u2019s stored in cloud environments. <\/p>\n\n\n\n

    Basically, these controls are a specific set of policies and procedures that help to ensure the security of any sensitive information that the third-party service providers are responsible for protecting. This differs from a SOC 1 examination, which focuses on financial reporting. Basically, this type of report is created by auditors, for auditors.<\/p>\n\n\n\n

    Well, considering your organization has to adhere to specific data security standards (think: CCPA, GDPR<\/a>, FIPS<\/a>, PCI DSS<\/a>, HIPAA<\/a>, etc.), then you should be able to expect that any third-party organizations you\u2019re contracted with to store or process your data online does the same\u2026 right?<\/p>\n\n\n\n

    If you believe that, then I have a bridge or two to sell you\u2026 and possibly a unicorn.<\/p>\n\n\n\n

    Unfortunately, not all service providers are stringent about protecting their own data. If your data isn\u2019t properly handled, it can leave you vulnerable to various security issues, including:<\/p>\n\n\n\n