Let’s Start with What SOC2 Is Not

A Systems and Organization Controls 2 (SOC2) examination is not a compliance engagement. An organization cannot be SOC2 “certified.” This is a common misconception.

What SOC2 Is

A SOC2 examination is an attestation governed by the American Institute of Certified Public Accountants (AICPA). It provides assurance over specific risks a service provider poses to its customers. Management of the service provider asserts that its system and organizational controls are designed and operating effectively to mitigate risks tied to service commitments and requirements. A Certified Public Accountant then performs auditing procedures and provides an opinion on whether those controls are properly designed and operating as intended.

In simpler terms, a SOC2 report communicates to customers that controls are in place and functioning to provide reasonable assurance that the organization is meeting its legal, regulatory, contractual, and service obligations.

Why SOC2 Is an Attestation, Not a Certification

The benefit of SOC2 being an attestation engagement is that the organization defines the scope of the system and services being reported on. This flexibility allows for a more customized and relevant report.

For example, a company may manage multiple applications but choose to report only on one that supports a specific industry with sensitive data or high availability requirements. SOC2 does not require a minimum or maximum number of controls. The depth and breadth of controls depend on the specific risks the organization poses to its customers.

Trust Services Criteria

SOC2 is based on the Trust Services Criteria issued by the AICPA. These criteria are divided into five categories:

  • Security (required for all SOC2 reports)
  • Availability
  • Confidentiality
  • Processing Integrity
  • Privacy

The Security category is often referred to as the Common Criteria because it applies across the entire organization. The inclusion of other categories depends on the services provided and customer expectations.

Preparing for a SOC2 Examination

Preparing for a SOC2 examination can be complex and stressful. To simplify the process, here is a checklist of key steps:

1. Define Your SOC2 Report Scope

  • Which customers will receive the SOC2 report?
  • What services should be covered?
  • What systems and applications should be included?

2. Select Your Trust Services Criteria

Choose the criteria based on the scope of your report:

  • Security
  • Availability
  • Confidentiality
  • Processing Integrity
  • Privacy

3. Perform a Readiness Assessment

This can be done internally or with support from a partner like Asureti.

  • Identify the boundaries of the system. Consider which risks are owned and managed by your organization.
  • Identify subservice organizations (vendors) that materially affect your services. This leads to defining Complementary Subservice Organization Controls (CSOCs).
  • Identify risks outsourced to customers. This leads to defining Complementary User Entity Controls (CUECs).
  • Review or prepare policies that govern expectations based on your scope and selected criteria.
  • Identify controls implemented to address the Trust Services Criteria through inquiry and observation.
  • Perform testing to confirm that controls are not only implemented but also operational.

4. Remediate Gaps

Address any control or documentation gaps identified during the readiness assessment.

5. Retest Remediated Controls

After implementing new controls or documentation, perform operational testing to confirm effectiveness.

6. Select a CPA Firm

Choose a qualified CPA firm to conduct the SOC2 examination.