SOC 2 Service :-  
     
 

What is SOC 2?

A SOC 2 audit assesses and reports on the internal control framework of a Service Organisation.

A SOC 2 audit report provides a service organisation’s management, user entities and other interested parties (clients, customers) with assurance about the system and organisation controls the service organisation has in place relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy and enable such users to assess and address the risks that arise from their relationship with the Service Organisation.

The SOC 2 audit report includes a detailed summary of the organisations system or service description including an overview of the company, the boundaries and interfaces, the systems and services provided and the system components.

The audit report also includes a management assertion or attestation provided by the Service Organisations Senior Management, confirming that the system or service description and controls identified are an accurate representation of the controls organisation actually has in place.

SOC 2 audits or SOC 2 reporting can only be performed by an independent CPA auditor or accountancy organisation. SOC auditors are regulated by the AICPA and CPA auditors are bound by the AICPA code of conduct. The auditor performs a SOC 2 audit or examination in accordance with the SSAE18 standard sections AT-C 105 and AT-C 205.

The SOC 2 audit report is not intended for general distribution, given the level of detail within the report and the sensitive and confidential nature of the information the report contains.

The AICPA Trust Services Criteria (TSC)
The AICPA Trust Services Criteria (TSC) is an independent, industry-recognised, third-party assurance standard that is used to audit service organisations, such as Cloud service and hosting providers, SasS software providers and developers, web marketing companies and financial services organisations. The AICPA TSC’s selected have to adequately address the risks to the system or service that the service organisation is providing to their clients.

There are 5 TSC categories Security, Availability, Processing Integrity and Privacy. These are split further across the 5 categories into 27 TSC criteria and 300+ points of focus. The points of focus provide details as to the features that should be included in the design, implementation, and operation of the control related to the particular criterion.

The 5 TSC categories are defined below:

1. Security or Common Criteria
Information & systems are protected against unauthorized access, disclosure of information and damage to systems that could compromise the entity’s ability to achieve objectives.

2. Availability
Accessibility of information used by the entity’s systems as well as the products or services provided to its customers.

3. Processing integrity
Information completeness, validity, accuracy, timeliness, and authorization of system processing.

4. Confidentiality
Ability to protect information designated as confidential from its collection or creation through its final disposition and removal from the entity’s control

5. Privacy
Personal information is collected, used, retained, disclosed and disposed [of] to meet the entity’s objectives.

SOC 2 Type 1 vs Type 2

SOC 2 Type 1
SOC 2 Type 1 service auditor reports on the fairness of the presentation of management’s description of the service organization’s system and the design effectiveness of the controls. The organisation has built in controls to manage and process information in manner that will ensure that the user organization does not have material misstatement.

SOC 2 Type 2
SOC 2 Type 2 service auditor reports on the fairness of the presentation of management’s description of the service organization’s system, opinion on the design effectiveness of the controls and on the operating effectiveness of these controls

Audit Report Structure
Part 1- Independent auditors report
Part 2- Management Assertion
Part 3- System Description
Part 4- Testing Results

Our Services

SOC 2 GAP Assessment
SOC 2 GAP Assessment process is designed to detect any holes that could lead to a finding during the AICPA SOC 2 audit. The assessment is designed to document any control concerns, and get you on a fast path to resolution prior to the start of the audit period. Whether you are undergoing a SOC 2 Type I audit or a SOC 2 Type II audit, we can assist you with prioritizing controls.

SOC 2 Consulting
SOC 2 audit collection process can take a considerable amount of time for your team. We can assist you with implementation, documentation of controls. Our implementation help in meeting audit expectations and requirements. This ensures a smooth process from start to finish.

SOC 2 Audit
SOC 2 audit requirements for end to end audit can be fulfilled and reported based on the SSAE 18 requirement. Our extensive experience in dealing with SaaS, Outsourcing, IT services and product companies to meet the right reporting requirements.

 
     
 
     
129166 Times Visited