SOC 2 Compliance

SOC 2 is an attestation report issued by an independent CPA firm under standards set by the American Institute of Certified Public Accountants (AICPA). It tells your customers how well your organization protects the systems and data you handle on their behalf. For SaaS, cloud, and managed-service companies, a SOC 2 report is often required before an enterprise customer will sign a contract.

The Trust Services Criteria

A SOC 2 examination evaluates your controls against the AICPA Trust Services Criteria. Security is always in scope; the other four categories are added when they matter to your customers.

• Security (required): protection against unauthorized access, use, or modification of systems and data.

• Availability: systems are available for operation and use as committed.

• Processing Integrity: processing is complete, valid, accurate, timely, and authorized.

• Confidentiality: information designated as confidential is protected.

• Privacy: personal information is collected, used, retained, disclosed, and disposed of appropriately.

Type I vs. Type II

• Type I evaluates whether your controls are suitably designed at a single point in time. It is faster and a common first step.

• Type II evaluates whether those controls operated effectively over an observation period, typically 3 to 12 months. Most enterprise buyers ask for a Type II.

How We Get You There

• Scoping: define systems, data, locations, and which Trust Services Criteria apply.

• Readiness and gap assessment: compare current controls to the criteria and produce a prioritized remediation plan.

• Remediation: policies, procedures, technical controls, vendor management, and evidence collection.

• Auditor coordination: help select a CPA firm and support you through fieldwork.

• Continuous compliance: vCISO oversight to keep controls operating between annual reports.

Resources

• AICPA: System and Organization Controls (SOC) Suite of Services

• AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022)

• NIST Cybersecurity Framework (CSF)

• Related: ISO/IEC 27001 and 27017 and HITRUST

Ready to Start?

Tell us about your environment and timeline and we will send a scoped proposal for SOC 2 readiness. Request a quote.

SOC 2 reports are issued only by licensed CPA firms. Temple of Epiphany provides readiness, remediation, and advisory services and does not issue SOC reports.