Experts in ethical hacking say that companies of any category outsource more and more services such as data storage and access to applications to service providers in the cloud. In response to this fact, the American Institute of Certified Public Accountants (AICPA) established the framework of Service Organization Controls (SOC), a standard for controls that safeguard the privacy and confidentiality of information that is stored and processed in the cloud.
Organizations must meet the constant and changing demands of the environment in which their customers are established. If the customers or prospects of one of these organizations request a SOC 2 report (an audit that measures the effectiveness of a security operations center’s system, according to the AICPA Trust Service Principles and Criteria), the process for its elaboration usually involves three steps:
Step 1: Preparation assessment
A preparation assessment will help your organization to prepare for an SOC 2 audit. Used as an internal assessment, this step provides your organization with a roadmap to prepare for a SOC 2 audit by identifying its current controls according to SOC 2 requirements, identifying gaps in the control, and making recommendations for close the gaps depending on your specific business.
Step 2: SOC 2 Report Type 1
After a preparation evaluation, most organizations look for a SOC 2 report type 1. With this report, an organization’s controls are evaluated at a specific time. The advantage of the SOC 2 report type 1 is that your organization can obtain a SOC 2 report at a specific time instead of during an audit period (as with a SOC 2 report type 2). A type 1 report acts as a screenshot of an organization’s environment to determine and demonstrate whether the controls are designed and in the right place.
The SOC 2 Audit Type 1 is also an opportunity to validate that the gaps identified during the preparation assessment were remedied and comply with the SOC 2 audit standards. For example, if during the preparation evaluation it is discovered that the system changes were not documented, during SOC 2 type 1 A recent system change will be selected to determine whether the defined and documented change management process has followed.
If it is a first year report of activities, specialists in ethical hacking from the International Institute of Cyber security recommend that organizations begin their compliance period with a Type 1 report, and then move to a type 2 in the Next audit period.
Step 3: SOC 2 Report Type 2
For a SOC 2 report type 2, your organization’s controls are assessed over a period of time, usually a twelve-month review period. A SOC 2 Type 2 report acts as a historical review of an organization’s systems to determine and demonstrate whether the controls are designed and at their place, and whether they work effectively over time.
Since, according to experts in ethical hacking, a Type 2 report is more complete than a Type 1 report, it often provides customers with a higher level of security and has become the standard expectation of customers and prospects. Thereafter, a SOC 2 Type 2 report is obtained annually.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
