Service Organizational Control (SOC 2) Compliance - Kloudlearn

Online course offering
SOC 2
Compliance
© KloudLearn www.kloudlearn.com

Learning
Objectives
© KloudLearn www.kloudlearn.com 2
Service Organizational Control (SOC)
Types of SOC 2 Reports
Test for Service Principles
The Five Trust Services Principles
Trust Principles Criteria Components
How does it Work?
What Does it Cost?
How Long Does it Take?

Service Organizational Control (SOC) 2
● Service Organizational Control (SOC) 2 reports are designed to ensure that if you are a service provider who
handles customer data, it will be transmitted, stored, maintained, processed, and disposed of in a way that is
strictly confidential.
● Introduced by the American Institute for CPAs (AICPA), SOC 2 compliance indicates to your customers that
you will handle their data with the utmost care.
● And in today’s data-heavy world, avoiding data breaches is crucial to your success as a business owner.
● If you are storing your client’s data in the cloud, being SOC 2 certified provides an added level of trust you have
with your clients

Types of SOC 2 Reports
SOC 2 Type 1 examines the controls used to address one of all Trust Service Principles. This audit type can
affirm that an organization’s controls are designed effectively.
SOC 2 Type 2 includes the same information, with the addition of testing a service organization’s controls
over a period of time
● Pick the Right Report
● Picking the right report will help you show your clients that you are a reputable service provider.
● Being SOC 2 compliant requires that you meet standard security criteria outlined by the AICPA, but the
other four trust service principles are not mandatory

Test for Service Principles
As a business owner, think of your customer’s needs and which service principles would best suit those needs.
SOC compliance checklists focus on five trust service principles that include:
● Security
● Availability
● Processing integrity
● Confidentiality
● Privacy
AICPA five trust principles for managing customers’ information - diagram by
Imperva

The Five Trust Services Principles
TSP section 100 provides criteria for evaluating and reporting on controls related to security, availability,
processing integrity, confidentiality, and privacy. In TSP section 100, these five attributes of a system are known
as principles, and they are defined as follows:
Security. The system is protected against unauthorized access (both physical and logical).
Availability. The system is available for operation and use as committed or agreed.
Processing Integrity. System processing is complete, accurate, timely, and authorized.
Privacy. Personal information is collected, used, retained, disclosed, and destroyed in conformity with the
commitments in the entity's privacy notice and with criteria set forth in generally accepted privacy principles
(GAPP)issued by the AICPA and CICA.
Confidentiality. Information designated as confidential is protected as committed or agreed.
Security Availability Processing Integrity Privacy Confidentiality

Trust Principles Criteria Components
● The following four components are represented in the respective principles and criteria.
● Policies – The entity defines and documents its policies for the ‘Trust Services Principle’ of its system.
● Communications – The entity communicates its defined ‘Trust Services Principle’ policies to responsible
parties and authorized users.
● Procedures – The entity placed in operation procedures to achieve its documented ‘Trust Services
Principle’ objectives in accordance with its defined policies.
● Monitoring – The entity monitors the system and takes action to maintain compliance with its defined
system Trust Services Principle’ policies

How does SOC 2 Work?
SOC 2 requires that management provide a written assertion and that such assertion be attached to
management's description.
Suitable criteria is the standard or benchmark used to measure and present the subject matter.
Management will select the criteria used to measure the and present the subject matter and will state those
criteria in the assertion.
Below is a subset of the criteria for determining whether the description of the service’s organization’s system
is fairly presented:
● Types of services provided
● Components of the system used to provide the services (infrastructure, software, people, procedures, data)
● Boundaries/aspects of system
● Information on subservice organizations
● Other aspects of the service organization’s control environment
● Any changes over the period represented.

What Does it Cost?
The cost of delivering SOC 2 reporting varies across different organizations.
The following factors will impact the cost of reporting for SOC 2:
● The size and complexity of your organization (number of employees, multiple locations, etc.)
● The number of Principles selected. You can select one, several, or all of the Principles.
● The Type of report (Type 1: design only vs. Type 2: design and operating effectiveness)
● The period covered by your report (6-12 months)
● The number of controls. You can include all of your controls or minimize the scope to only high level
controls or certain business areas to reduce cost and impact.
Remember this is an annual recurring report, so the upfront cost is always higher. Expect costs to lower by 10-
20% in subsequent years.

How Long Does it Take?
● Type 1 Report Planning and Scoping: 2-4 weeks
● Design Assessment: 3-4 weeks Reporting: 2 weeks
● Total Time: 7-10 weeks
● Type 2 Report Planning and Scoping: 2-4 weeks
● Design Assessment: 4-6 weeks (sometimes spread
over 2 periods)
● Reporting: 4 weeks
● Total Time: 10-14 weeks

Summary
● SOC 2 is an auditing procedure that ensures your service providers securely manage your data to protect the
interests of your organization and the privacy of its clients.
● For security-conscious businesses, SOC 2 compliance is a minimal requirement when considering a SaaS
provider.
● Service Organization
■ Provide a competitive advantage
■ The SO can avoid unexpected audits
■ Assist in building trust & confidence
● SOC2/3 can incorporate other publicly available frameworks such as ISO 2700x, PCI/ etc.
● User Organization
■ Provide an independent assessment
■ Assist with regulatory compliance
■ Reduce the possibility of additional audit costs
■ Increase audit efficiency

Test your knowledge!
Quiz
Quiz

Software Vendors
Cloud Providers
Large Companies
All the above
Who needs to be SOC
2 compliant?
13

SOC 2 requires AICPA
trust service criteria ?
14
True
False

SOC 2 applies to the
public cloud?
15
True
False

Implement all applicable administrative
policies and internal controls
Find a reputable AICPA-affiliated SOC 2 audit
firm
Both of them
None of the above
How to prepare for a
SOC 2 audit?
16

True
False
Are AWS, Azure SOC
2 compliant?
17

How do i meet SOC 2
requirements in the
cloud?
18
Establish administrative policies and
procedures
Set security controls to meet policy standards
Enforce and maintain security controls across
your cloud
All the above

How do i maintain SOC
2 compliance?
19
Compliance monitoring systems
Maintain security controls

What does SOC 2
certification cover?
20
System monitoring
Data breach alerts
Audit procedures
Forensics
All the above

Which matters to
certify to SOC 2
compliance?
21
Your existing compliance posture.
The size and complexity of your organisation.
The cost and availability of a SOC 2 auditor.
All the above

What does a SOC 2
audit report contain?
22
Management assertion;
A detailed description of the system or service;
Details of the selected trust services categories;
All the above

Thank You
KloudLearn, Inc. is headquartered in Silicon Valley, California. Our mission is to help
enterprises provide an engaging and impactful learning experience that improves
business performance. We provide the industry’s most modern LMS (Learning
Management System). For more information visit us at www.kloudlearn.com or reach
out to us at info@kloudlearn.com

Service Organizational Control (SOC 2) Compliance - Kloudlearn

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Service Organizational Control (SOC 2) Compliance - Kloudlearn

Similar to Service Organizational Control (SOC 2) Compliance - Kloudlearn (20)

More from KloudLearn

More from KloudLearn (8)

Recently uploaded

Recently uploaded (20)

Service Organizational Control (SOC 2) Compliance - Kloudlearn