SOC 2 – SOC for Service Organizations: Trust Services Criteria

Report on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality and/or Privacy

Attestation Standard: SSAE18

What is a SOC 2 Report?

The purpose of a SOC 2 report is to help customers understand controls in place related to security, availability, processing integrity, confidentiality, and/or privacy. SOC 2 reports help demonstrate compliance with regulations such as PCI, HIPAA, GLB, FIDICA, etc. Use of these reports is restricted.

There are two types of SOC 2 reports:

SOC 2 – Type 1 attests to whether management has demonstrated that they have designed appropriate controls to mitigate risks related to their services — as they pertain to users — as of a specified date.

SOC 2 – Type 2 is similar to Type 1 in that it attests that management has designed appropriate controls to mitigate risks related to their services — as they pertain to users — however, it also attests that these controls were operating effectively, and covers a specified period of time, rather than one date.

SOC 3 – SOC for Service Organizations: Trust Services Criteria for General Use Report

Attestation Standard: SSAE18

What is a SOC 3 Report?

The purpose of a SOC 3 report is to inform any interested parties about the operating effectiveness of internal controls at the service organization relevant to security, availability, processing integrity, confidentiality, and/or privacy, in connection with a SOC 2 engagement. The SOC 3 is a general use report that contains less detail than a SOC 2, but its distribution is not restricted.

SOC Readiness Engagements

Often, service organizations are unprepared for the results of the actual SOC 1 or SOC 2 examination, which may result in a delayed engagement, changes to the scope or reporting period, or even a “qualified opinion.” A SOC Readiness Engagement is an efficient means to prepare for your formal examination engagement. Our readiness engagements provide guidance regarding the scope of the examination engagement and identify to management where remediation is necessary to ensure that the control objectives (SOC 1) or applicable trust services criteria (SOC 2) are achieved. These engagements also help you to present the control activities already in place and allow consideration of whether appropriate documentation is maintained so that the operation of controls may be tested in the SOC 1 or SOC 2 engagement.

High Level “Quick Hit” Readiness Engagements are accomplished through interviews and reviews of any existing policies and procedures. We consider the design of controls only, with the deliverable focusing on the objectives or criteria where remediation is necessary.

Detailed Readiness Engagements consider both the design and implementation of controls. Our professionals will consider the design of controls in place, and then perform walkthroughs of those key controls to determine whether they have been implemented as designed.

Who benefits from SOC Readiness Engagements?

• Organizations contemplating their first SOC 1 or SOC 2 engagement
• Organizations transitioning from one SOC report to another (i.e., SOC 1 to SOC 2)