Using SOC 2 Reports to Safeguard Your File and Email Data Communications
SOC 2 reports are a great way to identify how well an organization safeguards their clients’ data. But creating a report may not be as easy as you think.
What Is SOC 2?
SOC 2 (System and Organization Controls 2) is a type of auditing process that assesses a service organization’s controls related to security, availability, processing integrity, confidentiality, and privacy. The SOC 2 report is issued by an independent auditor after an evaluation of the organization’s control environment. Organizations may undergo a SOC 2 audit to demonstrate their commitment to data security and compliance with regulatory requirements. SOC 2 reports are commonly used by cloud service providers, Software-as-a-Service (SaaS) companies, and other service providers to assure customers and stakeholders that they are managing risks effectively.
Who Needs a SOC 2 Report?
Organizations that need a SOC 2 report include cloud service providers, SaaS providers, and organizations that store client information in the cloud. A SOC 2 report proves a client’s data is protected and kept private from unauthorized users.
What Is a SOC Report?
SOC reports verify an audit of security controls for key attack surfaces. No particular industry requires these reports, but they are more often than not required by businesses in financial services, including banking, investment, insurance, and security. So, if you are a technical service provider (or hiring such a provider), then there is a good chance that either a client or business partner will require a SOC audit.
Within the System and Organization Controls framework, there are three different types of reports:
1. Types of SOC Reports: SOC 1 vs. SOC 2 vs. SOC 3
SOC 1, 2, and 3 all refer to the System and Organization Controls (SOC) reports developed by the American Institute of Certified Public Accountants (AICPA).
The SOC 1 report focuses on internal controls related to the financial reporting process, with specific emphasis on the controls that impact a company’s financial statements. It outlines the security controls implemented by an organization related to financial reporting. These reports, also known as the Statement on Standards for Attestation Engagements (SSAE) 18, demonstrate the organization has the business processes and technical infrastructure to properly report financials. Within SOC 1 attestation, there are two types of reports:
- SOC 1 Type I: Describes reporting and auditing controls in place and how they help achieve required reporting objectives
- SOC 1 Type II: Describes reporting and auditing controls in place but also includes an audit of the organization’s operational effectiveness or ability to meet reporting and control objectives
A SOC 2 report demonstrates an organization’s controls comply with the AICPA and their Trust Service criteria (see below). The SOC 2 report is designed to evaluate the internal controls associated with the systems that make up a company’s operations and security. It provides information on the effectiveness of the controls in place related to confidentiality, privacy, and security of the company’s systems. The SOC 2 report is designed to evaluate the internal controls associated with the systems that make up a company’s operations and security. It provides information on the effectiveness of the controls in place related to confidentiality, privacy, and security of the company’s systems.
A SOC 2 report is by far the most common report when it comes to security and data confidentiality, and the one you will most likely see referenced in terms of compliance with generally accepted data privacy controls. A SOC 2 certification provides an additional layer of security and trust with your clients or partners. Many service providers in industries like financial services, healthcare, and government contracting therefore pursue SOC 2 audits, even if they aren’t required.
The SOC 3 report is a public version of the SOC 2 report. A SOC 3 report summarizes a SOC 2 report, but focuses on a more general audience (like company stakeholders) rather than a technical one. This report is a subset of the SOC 2 report and is intended for public use. It provides assurance that the company’s systems meet certain standards of security, privacy, and confidentiality but does not contain specific details or results of the evaluation.
2. SOC 2 Type II: The Ultimate in SOC Compliance
SOC 2 Type II compliance provides a higher level of assurance than other types of SOC compliance. SOC 2 Type II compliance requires an independent audit that assesses the organization’s internal controls over the course of a minimum of six months. This audit covers not only the technology and processes within the organization, but also the organization’s policies covering security, availability, processing integrity, confidentiality, and privacy. The audit will assess whether these controls are operating effectively over the period of time and provide assurance that the controls are meeting the organization’s stated objectives. It also provides assurance to customers and other stakeholders that the organization is taking appropriate steps to protect their data. SOC 2 Type II is the most comprehensive type of SOC compliance and provides the highest level of assurance for organizations.
SOC 2 reports demonstrate the extensive security and reporting controls that an IT vendor or provider has in place to protect confidential data. SOC requirements are rooted in the five Trust Service criteria:
1. Privacy in SOC 2
How data is collected, used, retained, and disclosed as part of its use by an organization.
2. Confidentiality in SOC 2
Data designated as confidential remains confidential during use by an organization.
3. Security in SOC 2
Data is protected against unauthorized access, theft, breach, or disclosure, also called the “common criteria.”
4. Processing Integrity in SOC 2
All data processing systems are complete, valid, accurate, and timely based on an organization’s needs.
5. Availability in SOC 2
Data is visible and ready to use as part of a business’s processes.
These criteria address different forms of security controls, and an attestation is a demonstration that the organization implements those controls.
Not every SOC 2 report addresses or attests to all of these criteria. Each criterion, however, speaks to the completeness and rigor of an organization’s IT system (as it relates to that specific criteria). The security criteria are by far the most frequently audited, particularly for first-time attestation.
Additionally, SOC 2 reports come in two different types:
- Type I provides a “snapshot” of an organization’s system in relation to specific, essentially an “as of” date that attests to compliance.
- Type II offers a more in-depth report that involves a thorough examination of security controls, internal policies, and procedures over a period of time. Type II reports are often seen as a more complete form of attestation.
What Is the Scope of the SOC 2 Type II Report?
The scope of a SOC 2 Type II report focuses on how a service organization’s system is designed and operated to meet the applicable trust service principles and criteria. These principles and criteria are related to security, availability, processing integrity, confidentiality, and privacy of customer data. A SOC 2 Type II report provides an in-depth examination of the design and operation of the controls that the service organization has put in place to protect customer data. The service organization must demonstrate that the controls are suitably designed and operate effectively to meet the trust service criteria.
It is important to note that SOC 2 Type II reports are not intended to replace other audit or assurance services, such as traditional system and/or financial audits, penetration testing, or vulnerability assessments. Instead, they supplement these services with a focus on the controls and operation of a service organization’s information systems. This provides assurance that the service organization is adhering to the trust service principles and criteria and helps to ensure the security, availability, processing integrity, confidentiality, and privacy of customer data.
The Process of Getting SOC 2 Certified
Here is a “quick and dirty” checklist for organizations that want or need to become SOC 2 certified:
1. Understand the Requirements of SOC 2
Familiarize yourself with the standards and criteria of the Trust Services Criteria (TSC) for SOC 2 compliance.
2. Complete a Pre-assessment of SOC 2
Have an independent audit or review of your current policies, procedures, and other areas relevant to SOC 2 compliance.
3. Develop an Action Plan of SOC 2
Create a roadmap to achieving SOC 2 compliance, which should include all of the necessary steps and timelines.
4. Implement an Audit Framework of SOC 2
Develop and maintain a system of policies and procedures consistent with the requirements of the TSC. This includes a risk assessment of the technology used, a review of security settings, and the implementation of any necessary changes.
5. Undergo a SOC 2 Audit of SOC 2
This is typically conducted by an independent third-party audit firm. The audit will review your controls and processes and ultimately determine if you are meeting the criteria for SOC 2 compliance.
6. Monitor and Maintain Compliance of SOC 2
Regularly review and update your system controls and processes to ensure they remain in compliance with the SOC 2 standards.
How Long Is a SOC 2 Type II Report Valid?
A SOC 2 Type II report is valid for one year from the date it is issued, provided that there are no significant changes to the system or procedures examined. It is important to note that the report only applies to the specific components and processes evaluated during the scope of the audit, and it is not a general endorsement of an organization’s overall security posture. To maintain the validity of the report, organizations must ensure that all controls assessed as part of the audit remain effective over the course of the year. If any changes are made to the system or procedures examined, an updated report is required to reflect those changes.
What Is a SOC 2 Type II Audit?
A SOC 2 Type II audit is an in-depth review of a service organization’s controls and processes related to security, availability, processing integrity, confidentiality, and privacy of a system. It is more specific and focused than a Type I audit and can involve multiple locations, processes, and systems. The audit covers a period of at least six months, allowing the auditor to review the service organization’s details over that time frame. Additionally, the auditor will evaluate the design and operating effectiveness of the controls in place.
Best Practices for SOC 2 Compliance
It’s important to determine the scope of the audit beforehand. Not every business or business contract calls for adherence to every single Trust Criteria (although Security is most often used). If you don’t understand the scope or needs of an audit, your organization can waste valuable time and resources chasing attestations that aren’t needed.
It is imperative, obviously, that you understand your technical infrastructure prior to embarking upon an audit. If, for example, you aren’t utilizing compliant software, then naturally you’ll need to upgrade. If you are using a third-party platform or SaaS product, those solutions must be compliant.
You may, however, never need a SOC 2 attestation. An IT company working in healthcare, for example, must meet HIPAA requirements and these may be sufficient. Covered Entities (CEs) like hospitals or insurance companies may nevertheless require a SOC audit to ensure an additional level of scrutiny on your security systems. The same could be said for a financial services company that handles payment information. While they may meet Payment Card Industry Data Security Standard (PCI DSS) requirements, they may also opt to undergo SOC 2 audits for additional credibility.
Kiteworks Private Content Network SOC 2 Certified
For organizations requiring sensitive content communications that are SOC 2 certified, Kiteworks is an excellent option. Kiteworks has received SOC 2 certification six consecutive years and touts various other compliance achievements, such as FedRAMP Authorization for Moderate Level Impact, ISO 27001, 27017, and 27018, Cyber Essentials Plus, and Infosec Registered Assessors Program (IRAP) ASSESSED against PROTECTED level controls.
One of the key factors that contributes to Kiteworks SOC 2 certification is the use of a hardened virtual appliance that envelops its Private Content Network. The Kitework hardened virtual appliance employs multiple layers of security, including firewalls, intrusion detection and prevention systems, and endpoint protection, to reduce the vulnerability exploits and severity impact of cyberattacks. Kiteworks also meets rigorous SOC 2 compliance standards in the five categories established by the AICPA: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Security measures are in place to ensure that the platform is protected against unauthorized access, and is continuously monitored and audited for any suspicious activity. Availability is guaranteed 24/7/365, and the platform boasts processing integrity that is complete, accurate, timely, and authorized. Confidential information is protected, and personal information is treated with the utmost care and in accordance with AICPA and CICA guidelines.
In addition to the stringent SOC 2 compliance standards, Kiteworks also employs continuous monitoring and reporting to protect client data. This includes visibility of content storage, access, and use, as well as detailed, auditable reporting. Kiteworks’ data protection is also validated through SOC 2 compliance certifications and periodic external assessments according to SAS 70 Type II.
Organizations seeking to learn more about the Kiteworks Private Content Network can schedule a custom-tailored demo today.
Additional Resources
- Article SOC 2 [Everything You Need To Know]
- Article What Is FIPS Compliance and Compliant Technology?
- Article IRAP Compliance: Australian Cybersecurity Standards
- Blog Post Email & PCI Compliance
- Blog PostPCI Compliant File Sharing