We are living in a cloud-first world; cloud services, including storage services and SaaS providers, are wildly popular. Unfortunately, third-party vendor breaches are at epidemic levels, and new regulations such as the EU GDPR are seeking to hold organizations accountable if third-party business associates that store or handle their sensitive data, including their cloud vendors, are hacked. One way for businesses to protect themselves is to look for an SOC 2 Type 2 report when evaluating cloud vendors.
While cloud vendors are embracing the SOC 2 Type 2 to demonstrate their commitment to data integrity and security, many client organizations are still unfamiliar with this important audit standard.
What is an SOC 2 Report?
The SOC 2 is part of the American Institute of Certified Public Accountants (AICPA) SOC reporting framework and utilizes the AT-101 professional standard. Unlike the SOC 1, which focuses on financial reporting controls, the SOC 2 documents service organizations’ non-financial reporting controls. It was specifically designed for to address the needs of service organizations that store customer data in the cloud, including SaaS providers.
SOC 2 attestations are based on AICPA’s Trust Service Principles of Security, Availability, Processing Integrity, Confidentiality, and Privacy. Reporting organizations are not required to address each one of the Trust Service Principles; SOC 2 reports can be limited to the principles that are relevant to the services being provided. AICPA’s principles of Security attest that the organization protects information and systems against unauthorized access, information disclosure, and damage; and Privacy, which attests that the service organization collects, uses, retains, discloses, and disposes of personal information properly.
Type 1 vs. Type 2
There are two types of SOC 2 reports, Type 1 and Type 2. When evaluating a cloud vendor, always look for a Type 2. While a Type 1 audit provides a snapshot of an organization’s controls at a point in time, a Type 2 audit examines them over a specified period. The Type 1 is, thus, only preliminary to the Type 2. An SOC 2 Type 1 demonstrates that the provider has controls in place but has not yet audited them. A Type 2 demonstrates that they have tested the controls over a period of time and proven that they work.
SOC 2 Type 2 reports benefit both cloud vendors and their clients. Client organizations can rest assured knowing that their cloud vendors’ controls meet the highest standards of data governance and security. Cloud vendors are able to differentiate themselves in a crowded marketplace and enjoy their own peace of mind, knowing that they have proactive data governance and cyber security controls in place to protect their systems and their clients’ data.
While SOC 2 audits are time-consuming and rigorous, GRC automation technologies can make the process take far less time and go far more smoothly.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.