Obtaining SOC-21 Type 2 certification certification offers a number of benefits for customers of organisations such as PlanetHoster these days. As this standard is relatively little known, we have decided to devote an article to it, explaining what it is and the benefits it can bring to customers.
Safety: That Is Where It All Starts
Considering GDPR2 in Europe and Quebec’s Law 253, when the sometimes inappropriate use of artificial intelligence undermines cybersecurity, our customers are surely aware of how vitally important it is to protect their data.
Since its inception as a company, PlanetHoster has also remained highly conscious of its heavy responsibilities. And rightly so. Because customers trust that their online data will be protected.
Specifically, the System and Organization Controls 2 (SOC 2) standard established by the American Institute of CPAs (AICPA) sets out specific rules to ensure cybersecurity compliance. To this end, it describes ways in which organizations can make sure that their customer data is stored and processed securely. A formal audit report results from a SOC 2.
PlanetHoster already applies industry best practices in information technology (IT) security. Although there is no obligation to comply with the SOC 2 standard, as we will see, it is fair to say that the benefits outweigh the costs.
What Are The Advantages Of SOC 2?
In addition to increasing customer confidence, the main benefits of SOC 2 include:
- Better risk management. Evaluating and improving internal cybersecurity controls reduces the likelihood of data breaches or business disruptions.
- Market access and improved credibility. Many organizations only do business with SOC 2-certified companies, which gives them a competitive advantage. We know that potential customers, particularly in the United States, may require this standard.
- Operational efficiency. Because it is recognized by many entities, a certification such as SOC 2 saves a lot of effort. It reduces the workload involved in completing documentation to report to customers on data storage and processing practices.
A Few Words About Audits
As mentioned above, an independent entity must conduct a rigorous assessment of compliance with the SOC 2 standard. More specifically, after conducting an audit of an organization’s data security in accordance with SOC requirements, an independent certified public accountant (CPA) must produce a report.
There are two possible levels or types of reports:
First, the Type 1 report describes the organization’s systems at a specific point in time. Distributed internally, this report confirms that the design of the specified controls meets the expected principles of trust.
On the other hand, the Type 2 report validates the effectiveness of these same controls over time. The validation period generally varies between six months and one year. This report is also distributed internally.
What Are The Five Principles Of The SOC 2 Standard?
A SOC 2 audit is based on five key principles:
- security;
- availability;
- processing integrity;
- confidentiality; and
- privacy.
The first principle, security, is mandatory. It is often referred to as the “common criterion.”
The other four are chosen on a case-by-case basis, depending on their applicability to the industry being audited and the services it provides. The needs of customers in the industry in question also influence this choice.
Let’s take a closer look at all of this.
1. Security
The objective of the security audit is to verify that unauthorized access is denied.
Security encompasses the protection of information at the time of its collection, creation, use, processing, transmission, and storage. It also refers to the protection of systems that store, process, or transmit data related to the services provided by the organization.
The most important physical and logical tools that promote information technology (IT) security remain, among others:
- firewalls;
- intrusion detection; and
- multi-factor authentication (MFA) of users.
Based on the results of the assessment of the tools in place, recommendations are made in the TOC 2 audit report to address gaps and correct vulnerabilities observed.
2. Availability
The availability audit focuses on a number of elements, including, in particular, the assessment of the availability of services provided by suppliers.
It also includes the performance of the network itself, in the sense that customers expect their systems to function and be used as agreed. These must be accessible and usable, minimizing downtime and ensuring reliability.
This principle is typically categorized by the implementation of:
- redundant systems;
- backup and recovery processes; and
- emergency recovery plans.
3. Processing integrity
This type of audit aims to validate that there are no errors resulting from the system’s processing: it must be complete, accurate, timely, and authorized. Data integrity and accuracy are ensured by focusing on the correct and authorized operation of the system.
The audit ensures that, if errors occur, they are detected and corrected quickly, without compromising services and operations. A review of the data must also confirm that it is presented on time and in the correct format.
With this in mind, two measures must be put in place:
- quality assurance; and
- process monitoring.
4. Confidentiality
The confidentiality audit ensures that information designated as such is only visible to those with the appropriate authorizations. The focus is on protecting sensitive information from unauthorized access and disclosure.
Confidentiality depends on:
- particularly rigorous privileged access controls;
- data classification;
- encryption;
- IT mapping;
- data retention and disposal; and
- firewalls for networks and applications.
5. Protection of personal information
This audit assesses privacy compliance and measures the degree of protection of personal information itself. Similar to confidentiality, the principle of personal information protection focuses more on how sensitive user data is stored and used.
By definition, it ensures that personal information is collected, used, stored, disclosed, and disposed of in accordance with the commitments made in the organization’s privacy notice. The AICPA criteria also govern the protection of personal information, in accordance with generally accepted privacy principles.
To achieve this, the following measures are used:
- access control;
- MFA; and
- encryption.
Conclusion
We hope this article has helped you understand what SOC 2 audits are and why many organizations plan to conduct them.
It should be noted that the System and Organization Controls 2 (SOC 2) standard established by the AICPA sets out specific rules to ensure cybersecurity compliance. Supported by an audit report, it proves that the certified organization’s customer data is stored and processed securely.
It should also be noted that a Type I audit report demonstrates that the design of the specified controls meets the principles of trust expected at a specific point in time. A Type II report validates the effectiveness of these same controls during a specified validation period (generally six months to one year).
Finally, it is worth noting that a SOC 2 audit is based on five principles: security (mandatory), availability, processing integrity, confidentiality, and privacy.
- Prononunce “Sock 2”. ↩︎
- General Data Protection Regulation (GDPR). European legislation regulating the collection, storage, and use of personal data. ↩︎
- Quebec law that strengthens privacy protection by requiring businesses and organizations to be more transparent and accountable with regard to the collection, use, and protection of citizens’ personal data. ↩︎
