Information security is a reason for concern for all organizations, including those that outsource key business operation to third-party vendors (e.g., SaaS, cloud-computing providers). Rightfully so, since mishandled data—especially by application and network security providers—can leave enterprises vulnerable to attacks, such as data theft, extortion and malware installation.

SOC 2 is an auditing procedure that ensures your service providers securely manage your data to protect the interests of your organization and the privacy of its clients. For security-conscious businesses, SOC 2 compliance is a minimal requirement when considering a SaaS provider.

Developed by the American Institute of CPAs (AICPA), SOC 2 defines criteria for managing customer data based on five “trust service principles”—security, availability, processing integrity, confidentiality and privacy.

There are two types of SOC reports:

1. Type I describes a vendor’s systems and whether their design is suitable to meet relevant trust principles.
2. Type II details the operational effectiveness of those systems.

 

SOC 2 certification

SOC 2 certification is issued by outside auditors. They assess the extent to which a vendor complies with one or more of the five trust principles based on the systems and processes in place.

Trust principles are broken down as follows:

• 1. Security
• 2. Availability
• 3. Processing integrity
• 4. Confidentiality
• 5. Privacy