SOC 2 Requirements

As more stakeholders and clients value security compliance in their third-party service providers, it’s become more important than ever to seek SOC-2 certification if it applies to your business. A core element of the audit process is thoroughly understanding the SOC-2 requirements so they can be applied adequately.

SOC-2 differs from ISO 27001 in the sense that there are no rigid SOC-2 requirements. Instead, it offers suggestions based on the AICPA’s Trust Services Criteria (TSC). SOC-2 allows you to choose from these requirements based on what is relevant to your business to demonstrate compliance via the applicable internal controls.

Here, Hicomply explains the SOC-2 requirements and how your business can use these to solidify your security offering.

What are the AICPA points of focus?

Instead of providing a specific SOC-2 requirements checklist, the American Institute of Certified Public Accountants (AICPA) has provided guidance through its Trust Service Criteria (TSC), which instructs businesses on structuring an audit.

The AICPA also offers Points of Focus that help companies implement controls to satisfy the requirements for each Trust Services Criteria. Each business seeking SOC-2 certification must assess which controls it adds to its system to meet compliance standards.

Which SOC-2 requirements should my business follow for compliance?

Before conducting a SOC-2 audit, you’ll need to understand the details of the TSC. These are:

• Information security: How data is protected from unauthorised use.

• Logical and physical access controls: How your company manages and restricts unauthorised access.

• System operations: How your company manages system operations to ensure no process deviations.

• Change management: How your business implements controlled change management processes to prevent unauthorised changes.

• Risk mitigation: How your business identifies and mitigates risk for business disruptions and vendor services.

What are the Trust Services Criteria?

In total, there are five Trust Services Criteria that would be valuable to include in your audit. These are:

Security

Security is the only SOC-2 requirement that isn’t optional. The security criteria cover defences against attacks, ranging from malicious individuals gaining unauthorised access to your servers to negligent or improperly trained employees.

To cover the security SOC-2 requirement, an auditor may look for rigid firewall systems or two-factor authentication processes. They may also look at your company’s training processes and the background checks in place during hiring processes.

Privacy

Privacy criteria cover any information that’s considered sensitive in nature – usually personal information. To meet the privacy SOC-2 requirements, the organisation must openly communicate its privacy policies to anybody whose data it stores.

When your business collects sensitive or personal information from a customer or client, it must:

• Receive consent before collecting information

• Collect as little information as necessary

• Obtain the information through lawful means

• Use the information only for essential purposes

• Destroy the information after a defined data retention period

Confidentiality

Unlike private information, confidential information must be shared with other parties to be helpful, such as sensitive health data that must be passed between healthcare professionals.

The aim of the confidentiality SOC-2 requirement is to ensure that applicable information is processed and transmitted securely.

Processing Integrity

As a SOC-2 requirement, processing integrity assesses whether a service provider can be trusted in all aspects of its work. It tests whether the systems used to store, process, and retrieve information work as they should.

This includes the organisation’s ability to define the data it needs to achieve its goals, or whether the inputs and outputs are as described.

Availability

The aim of the Availability control is to minimise system downtime. A core component of this SOC-2 requirement is risk assessment.

A1 series controls require companies to:

• Predict the system capacity

• Identify, address, and mitigate environmental threats

• Identify data that needs to be backed up

What is a SOC 2 readiness assessment?

It’s generally recommended that companies conduct a readiness assessment before a SOC-2 audit, as this will assess whether their organisation is ready to seek compliance. The readiness assessment works a bit like a practice exam, so it’s worth taking one once you’ve reviewed the TSC, applied the relevant criteria, and documented the controls.

A qualified auditor will conduct the readiness assessment and follow up with a letter containing feedback on your security strengths and weaknesses, highlighting where the business needs to improve to become SOC-2 compliant. If your business follows this guidance, it will likely ace the SOC-2 audit.

Meet SOC-2 requirements with ease with Hicomply

With the Hicomply ISMS platform, your business is able to achieve and maintain SOC-2 compliance as you work, so all you need to focus on is what you do best – running a business!

Ready to start preparing for your SOC-2 audit? Get in touch now to try a demo.