What is SOC 2 Compliance?
Developed by The American Institute of Certified Public Accountants (AICPA), the primary goal of SOC 2 is to establish standards for the management of data security in an organization. It provides 5 key controls to help companies manage customer data, known as the Trust Service Principles (TSP). SOC 2 compliance is now one of the most common requirements from business that mandates a third-party assessment of your security controls.
Our penetration testing services are designed to facilitate compliance with the SOC 2 security testing requirements.
Reasons to Become SOC 2 Compliant
Secure Business Partnerships
Improve Your Security Measures
Prevent Incidents & Financial Losses
Protect Your Brand's Reputation
Appeal to Investors & Buyers
Comply With 3rd-Party Requirements
Need to Comply With the SOC 2 Penetration Testing Requirements?
Types of SOC 2 reports
There are two ways to approach SOC 2 compliance:
- Type I – describes a vendor’s systems and whether their design is suitable to meet relevant trust principles.
- Type II – details the operational effectiveness of those systems.
Type 1 reports can be compared to a simple “note to reader” financial statement. Type 2 reports, on the other hand, can be compared to an audited financial statement. Therefore, the most involved, detailed, and valuable certification that evaluates your operations is a Type 2 report.
The Trust Service Principles of SOC Compliance
Privacy Controls
Personal information is collected, used, retained, disclosed and disposed [of] to meet the entity’s objectives.
Confidentiality
Information designated as confidential is protected to meet the entity’s objectives.
Availability
Information and systems are available for operation and use to meet the entity’s objectives.
Processing Integrity
System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
Security
Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
