SOC Reports Explained: Service Organisation Control Necessity

A SOC report is performed by a certified public accountant (CPA) qualified by the American Institute of Certified Public Accountants (AICPA).

An audit starts the process, and while no one likes to think about having an outsider riffle through sensitive items, the benefits are clear. If you deal with sensitive information and you want to prove that you're qualified, SOC reports could help.

Types of SOC reports

The AICPA developed SOC report frameworks. The organisation continues to add audit options based on client need. Multiple types exist.

So-called "service organisations" that handle some type of data for customers have three SOC reports available:

• SOC 1: Financial data is the exclusive focus of the SOC 1 report. Outline how you protect and safeguard information regarding finances, and see if an auditor agrees that your plans are sufficient.

• SOC 2: Prove that you meet some or all of five identified criteria. They include privacy, confidentiality, processing integrity, availability, and security.

• SOC 3: Move through much of the same audits as you do for a SOC 2, but obtain a report that’s less technical and includes a seal of approval. You can share this report in a public space, such as a website.

You may also tap into cybersecurity SOC reports. You’ll detail how you take a proactive approach to risk management. And the auditor could help you spot gaps in your plan that leave you vulnerable.&

Manufacturing groups may also use SOC supply chain reports. Here, auditors look over your systems and controls to understand the risks within your supply chains.

SOC audit process explained

To begin, you must choose the report that is right for your organisation. Remember that this isn't an either/or endeavour. If your company works with both financial data and other information, you could need more than one report.

When you've chosen the report you need, you will:

• Create a SOC Readiness Assessment. You’ll prepare for your audit by examining your gaps and deficiencies.
• Find a partner. You will need a CPA to do the work for you.
• Be open and honest. You’ll need to provide your team with full access to do the work. Don’t hide anything.
• Read the report. You’ll get the information from your CPA filled with data. You may have items on your to-do list to fix after reading the report.

Should you get a SOC report?

Any company hoping to spot security gaps could benefit from a SOC report. But some organisations are required to do them.

You could need a SOC report if you work in:

• Finance
• Medical claims
• Loan processing
• Software as a Service

If you handle data for customers, no matter the type, you could also benefit from a SOC report. It's the only way to assure your new clients that you take security seriously.

At Okta, we specialise in helping organisations just like yours keep information safe and secure. Contact us to find out how we can help.

References

System and Organization Controls: SOC Suite of Services. AICPA.