Start your SOC 2 attestation journey here
SOC 2—System and Organization Controls 2—establishes criteria to help your organization manage and protect sensitive customer data. The American Institute of CPAs (AICPA) developed SOC 2 criteria for reporting and auditing processes, which are based on five trust service criteria (TSC):
Unlike more stringent frameworks such as the Cybersecurity Maturity Model Certification (CMMC) or PCI DSS, SOC 2 is not a regulatory requirement. However, demonstrating your organization meets SOC 2 criteria is a great way to show your customers, partners, and key stakeholders that your company values and applies SOC 2 standards for product or service delivery. And many organizations submit themselves to SOC 2 audits to provide attestations of compliance to their customers.
In this SOC 2 fundamentals page, we’ll take a closer look at the five criteria, formerly known as principles, and help you get a better understanding of each, explain how to become SOC 2 certified, and offer tips to help you streamline your SOC 2 audits.
System and Organizational Controls 2 (SOC 2) outlines criteria you can use to manage and protect customer data in the cloud.
Learn MoreApptega makes managing SOC 2 compliance simple with access to automated reports, alerts, notifications, policy templates, and framework mapping.
Learn MoreYou can use SOC 2’s Trust Services Criteria to develop your cybersecurity program and mature it over time.
Learn MoreIf your organization stores, processes, or transmits customer data, then SOC 2 is right for you. SOC 2 should also be used to evaluate SaaS providers.
Learn MoreSOC 2 Trust Services Criteria (TSC) outline five key principles to help you develop controls to help keep customer data safe.
Learn MoreSOC 2’s TSCs align with 17 COSO principles. See what they are and how you can apply them to your cybersecurity program.
Learn MoreSOC 2 Points of Focus help you determine which controls apply to your organization and how to implement them.
Learn MoreSOC 2 includes 61 compliance categories. See what they are and learn how Apptega can help you simplify control management.
Learn MoreYou’ve invested time and resource-building your SOC program, now check out these great tips to ace your SOC 2 audit.
Learn MoreWondering how to begin your SOC 2 compliance journey? Check out “SOC 2 Audits Explained for SaaS Companies” and other blogs for support.
Learn MoreWant to ensure your investments into SOC 2 pay off? Check out, “Secrets to Passing a Cybersecurity Audit” for help.
Learn MoreHave questions about SOC 2? This SOC 2 frequently asked questions section is a great place to start.
Learn MoreYou can map SOC 2 TSCs to other frameworks including ISO 27001 and NIST CSF. Apptega makes it simple with Harmony.
Learn MoreSearching for tools, guidance, and assistance with SOC 2 compliance? Try the SOC 2 Marketplace.
Learn MoreSystem and Organization Controls (SOC) 2 attestation, similar to certification, is a great way to demonstrate your organization takes data protection and privacy seriously and that you have controls in place that support those standards.
While some common cybersecurity frameworks and requirements, for example, the General Data Protection Regulation (GDPR), set rigorous standards your organization must meet for compliance, you can use SOC 2 criteria to create controls specific for your organization’s unique needs, as long as they align with the one of the five SOC 2 Trust Services Criteria (TSC):
SOC 2’s origins are rooted in the Statement of Auditing Standards No. 70, also known as SAS 70, from 1992. Certified public accountants (CPAs) originally used SAS 70 standards to conduct audits to determine how well service organizations manage information security controls and similar processes. For the purposes of SOC criteria, a service organization is any third party that provides services to your organization as a part of your organization’s information systems.
In 2010, the American Institute of CPAs (AICPA), replaced SAS 70 auditing with the Statement on Standards for Attestation Engagements No. 16 (SSAE 16). From SSAE, two new auditing reports emerged—SOC 1 Type 1 and SOC 1 Type 2. Type 1 reports focus on your organization’s capabilities on a specific date, whereas Type 2 reports focus on your controls on an ongoing basis.
SOC 1 focuses primarily on controls related to your financial reporting—Internal Controls Over Financial Reporting (ICFR).
SOC 2 focuses on the protection of data, evaluating your controls for those five TSCs we mentioned earlier. SOC 2 also includes a description of your service auditor’s tests of your controls and related results. Those reports are generally not made public.
There is also a SOC 3, which is similar to SOC 2, but it doesn’t include a description of a service auditor’s tests of controls and results, like SOC 2 does, so you can share it with the public, for example, on your website or social media.
Want to learn more about the evolution of SOC 2 from SAS 70 to the present? Check out, Explaining SOC: Easy as 1-2-3.
Apptega’s cybersecurity management platform can help you build your SOC 2 program simply and easily based on industry best practices and the SOC 2 framework. It’s a great resource to help you as you develop and mature your program over time, giving you comprehensive visibility not only into how well you’re meeting your SOC 2 criteria but if your organization uses other frameworks to manage cybersecurity, you can get instant insight into your performance with those too. You can even map multiple frameworks together in the Apptega solution.
Apptega will support you along your SOC 2 compliance journey before, during, and after your audit processes.
Apptega can help you with your SOC 2 needs, including:
Successfully obtaining a SOC 2 attestation shows your customers, vendors, and key stakeholders that your organization takes data security seriously and that you’re committed to protecting your customers’ sensitive and protected data.
You can use SOC 2’s five core Trust Services Criteria (TSCs)—security, availability, processing integrity, privacy, and confidentiality—as a starting point to develop a basic cybersecurity program for your organization that you can mature over time. You can even use SOC 2 criteria to develop specific TSC-related controls that are unique for your internal processes.
In this SOC 2 Compliance Guide, you can learn more about:
Preparing for a SOC 2 audit may not be as challenging as you think. Unlike other more stringent frameworks, you have a lot of flexibility in building cybersecurity controls that work great for your specific organizational needs—as long as they align with SOC 2’s five Trust Services Criteria. See how Apptega can help.
Companies of all sizes use Apptega to manage and report on their SOC 2 compliance.
In just three minutes, this video explores how you can use Apptega to:
Although no industry requires a SOC 2 certification, successfully completing a SOC 2 attestation reassures your clients and regulatory agencies that your organization has controls in place that guide security, availability, processing integrity, confidentiality, and privacy.
But it’s more than just a one-time effort to check the boxes and show that you have these controls set up. A SOC 2 attestation demonstrates your controls are effective and working. You can even assess and report on that effectiveness on a continual basis.
So how do you know if a SOC 2 certification is right for you? Generally, if you’re a service organization, and your store, process, or transmit sensitive or customer data, then a SOC 2 attestation is a good idea. Think of it as a less stringent (or starting point for an) ISO 27001 certification. And, if you outsource any of your work and share customer data with contractors or subcontractors, they should be SOC 2 compliant as well.
There are a number of benefits of adopting a SOC 2 approach for your security processes. From competitive advantage to potential cost-savings, these controls can give you more organizational insight, help you more efficiently manage your vendors and cybersecurity programs, guide internal governance and practices, help with risk management, and even guide regulatory oversight.
And, since SOC 1 deals with financial reporting, you’ll still need SOC 2 to evaluate your internal controls for information security related to the five Trust Services Criteria.
If you’re just beginning to develop your organization’s cybersecurity standards, SOC 2 is a great place to start.
Apptega is ideal for managing cybersecurity and compliance based on a variety of frameworks. Within the platform, you can automate the implementation and management of your compliance progress for all of the SOC 2 requirements, including:
SOC 2 provides organizations with best practices to help you manage your cybersecurity posture and meet compliance criteria. Apptega can show you the way to get the most out of your SOC 2 compliance journey.
The SOC 2 core is built on Trust Services Criteria (TSC). You can use TSCs to determine the effectiveness of your organization’s controls related to security, availability process integrity, privacy, and confidentiality. These controls are for information processed by your systems, not just at your primary location, but also if you have divisions or other operating units that conduct or support functions within your organization.
While TSCs focus on controls, effective SOC 2 practices also require sound judgment, facilitated by points of focus, which we’ll go into more detail in the next section (or if you’d like to go ahead and learn more, check out the Points of Focus section below).
TSCs are also aligned to 17 principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. Those 17 principles are categorized in a series of classifications (check out the Common Criteria Section below).
There are no regulatory requirements for SOC 2, so you can choose to meet one, some, or all of the TSCs. You can even begin with one or two and then build your controls out to meet more TSCs over time as you mature your program. While these are not in a specific required order, it’s a good idea to begin with the Security TSC.
The Security TSC is the most common criteria used by most organizations. It guides protection of information as your organization collects, uses, processes, transmits and stores it, as well controls for the systems that access, transmit, and store that data. Your security controls should ensure that information is protected from unauthorized access, unauthorized disclosure, and system damage that could put sensitive data at risk.
The Privacy TSC guides how your organization handles personally identifiable information (PII) such as names, addresses, phone numbers, etc. Consider the Privacy TSC as a tool to help you align your practices with your privacy notice. There are specific privacy criteria that include: notice and communication of objectives, choice and consent, collection, use, retention, and disposal, access, disclosure and notification, quality, monitoring and enforcement.
The Availability TSC focuses on ensuring information and systems are available for use and meet your objectives. It guides controls to support system access for operations, monitoring and maintenance.
The Processing Integrity TSC focuses on ensuring that your system processes are complete, accurate, timely, and valid.
The Confidentiality TSC applies to a gamut of sensitive data and guides how your organization protects that information from the time it’s collected or created all the way through to when and how your organization disposes of it or removes it from your organizational control.
All TSCs include sub-criteria that align to the 17 COSO principles. There are also additional criteria not directly COSO-related. These common criteria are at the core of a SOC 2 audit. In total, all 9 common criteria classifications span the range of information security controls.
Pro tip: Considering doing your first internal audit by focusing on these criteria to see how well you’re doing and identify SOC 2 gaps before you complete a formal assessment.
In addition to these COSO-focused principles, each TSC has additional criteria you can use to strengthen and mature your SOC processes. To see the full list, check out AICPA’s Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy Guide.
The control environment criteria has 5 related principles:
The communication and information criteria has 3 related principles:
The risk assessment criteria has 4 related principles:
The monitoring criteria has 2 related principles:
The control activities criteria has 3 related principles:
The logical and physical access criteria has 8 related principles:
The systems operations criteria has 5 related principles:
The change management criteria has 1 related principle:
The risk mitigation criteria has 2 related principles:
When we introduced the Trust Services Criteria, we mentioned how each criterion also has points of focus. The purpose of these points of focus is to help you identify the important characteristics of each TSC. These points of focus can help you design your controls as well as guide the development and maturity of your security practices. You can further use points of focus as guide points to evaluate how well your existing controls work and identify where you may need to make changes or improvements.
It’s important to note that not every point of focus outlined in SOC TCSs are relevant to every organization. You can use the points of focus to help customize your controls based on your organization’s needs.
While the extensive list of points of focus for each of the TSCs and related common criteria is too lengthy to outline here, let’s take a quick look at an example:
Common Characteristic: Control Environment
CC 1.1 Principle: The entity demonstrates a commitment to integrity and ethical values.
COSO-Related Points of Focus:
Additional Points of Focus:
To see a full list of SOC 2 Points of Focus, check out AICPA’s Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy Guide.
After you’ve established your SOC controls, you’ll need to hire a certified public accountant to conduct your SOC 2 audit.
Here are a few tips to help you prepare:
As cyber-attacks increase across many industries, it’s important that your clients know—and trust—that your organization takes data security and privacy seriously. And now, more than ever, people need reassurances (and proof) that your organization has controls to keep their data safe. This trust is built on transparency and professionalism, both of which are industry best practices and vital components on AICPA’s trust services criteria. As a SaaS company, a SOC 2 audit can help you demonstrate to your clients that you’re taking proactive measures to ensure your client’s data is safe.
Read MoreToday’s modern enterprises—regardless of size—depend on a variety of frameworks to help build cybersecurity programs and ensure compliance and regulatory standards are met. Most organizations today face an increasing number of compliance mandates, which simultaneously increasing the number (and variety) of security frameworks they use to increase their cybersecurity posture. Managing those frameworks or mapping them to one another has long been a challenge for security professionals—until now, thanks to Apptega’s Harmony, the only intelligent framework mapping tool you’ll ever need.
Read MoreConfiguration management is a way to identify, control, track, and audit changes as part of your cybersecurity program. Many security frameworks include configuration management in requirements. Whether you’re using recommendations like SOC 2 or more stringent requirements like ISO 27001, it’s important to understand the role of configuration management in keeping your organization safe. Check out this blog to learn more about how the two practices together to help increase your security posture.
Read MoreThere are more than 20 common cybersecurity and privacy frameworks available today, ranging from comprehensive requirements mandated by GDPR to recommendations like SOC 2. So how do you know which framework (or multiple frameworks) are best for your organization? Check out this on-demand webinar to learn more about common frameworks, what sets them apart, and how you can simplify framework management by using Apptega.
Watch NowIf you’ve invested time, money, and resources into building out your SOC 2 controls, you’ll want to do everything you can to ensure you have a successful SOC 2 audit. But where do you begin? How do you prepare? Check out this on-demand webinar to learn more from security experts that have been involved in auditing processes, learn more about common stumbling blocks, and get tips to help you prepare for a successful audit.
Watch NowAs a SaaS company, your clients want to know that their data is secure within your organization, and with any related subcontractors you might outsource work to. But how do you build an effective cybersecurity program for your SaaS business, especially if you’re just getting started? Check out this on-demand webinar to learn how you can use SOC 2 and other frameworks to build your cybersecurity program with your existing resources.
Watch NowDid you know that you can map SOC Trust Services Criteria to other cybersecurity and privacy frameworks? AICPA provides a mapping outline for free for the following frameworks:
AICPA’s mapping support is downloadable as a spreadsheet, but Apptega can help you greatly simplify this process, no matter how many frameworks your organization uses.
With Apptega’s Intelligent Framework Mapping, Harmony, you can easily consolidate controls by selecting the frameworks you need in the Apptega library, which are fully customizable, build your own, or customize a combination that works best for you.
Searching for tools, guidance, and assistance with SOC 2 compliance?
The SOC 2 Marketplace in CyberXchange is mapped to all the controls defined in the SOC 2 framework. For each of your gaps or compliance deficiencies, you can instantly find solutions mapped to your specific needs. Guesswork is eliminated. The research is already done for you.
Join thousands of CISOs, CIOs and other cyber professionals who are already finding perfect-fit solutions.
©2023 All Rights Reserved. Apptega® is a registered trademark Apptega, Inc. | Privacy Policy