SOC 2 Certification

According to a survey by the Federal Statistical Office, the number of people working from home for their company doubled from 12.8 percent in 2019 to 24.8 percent in 2021. One of the main reasons was the corona pandemic.

gold-outline

The Work-From-Home Revolution

Aber auch die Auswirkungen von „New Work“ sorgen dafür, dass viele Arbeitnehmer ihre beruflichen Aufgaben von Zuhause übernehmen. Für Unternehmen bedeutet das, dass sie hochverfügbare, leistungsfähige und flexible Cloud-Lösungen anbieten müssen, damit die Mitarbeiter auf Informationen und Daten jederzeit und zuverlässig zugreifen können. Auf der anderen Seite müssen diese Lösungen auch absolut sicher sein. Die Daten müssen bestmöglich vor Diebstahl, Verlust und Malware geschützt werden. Mit einer SOC 2-Zertifizierung sind sichere Cloud-Lösungen garantiert. 

What Does SOC 2 Stand for?

System and Organization Controls – this is what the abbreviation SOC stands for. This means: SOC are the internal controls and all procedures with which a system is protected against unauthorized access, modification and use. The renowned auditing body American Institute of Certified Public Accountants (AICPA) publishes the internationally recognized standard “SOC”. The largest US professional association of auditors, the SOC, sets out different guidelines that auditors must follow during an audit.

This includes:

  • SOC 1 — SOC for Service Organizations: Tipp: Internal Control over Financial Reporting (ICFR)
  • SOC 2 — SOC for Service Organizations: Trust Services Criteria
  • SOC 3 —SOC for Service Organizations: Trust Services Criteria for General Use Report
  • SOC for Cybersecurity
  • SOC for Supply Chain

If you want to certify cloud providers, the SOC 2 standard is used. Cloud solutions should meet certain “Trust Services Criteria” for data security and data protection.

gold-outline

The Trust Services Criteria are:

gold-outline

Security:

It is ensured that all information and systems are protected against unauthorized access and disclosure of information as well as damage to the system. This ensures the availability, confidentiality, integrity and data protection of information and systems.

Availability:

All information is always accessible to all authorized parties. The systems also contain controls to support operational accessibility. This also ensures accessibility for maintenance and monitoring.

Integrity:

This is where system processing comes into focus. All systems must be free from errors, omissions, delays or accidental tampering.

Confidentiality:

All sensitive information must be accessible to companies using the systems in accordance with the law and in accordance with company policies, while at the same time being absolutely protected. This applies from the time the data is collected until it is finally deleted.

Privacy Policy:

Data protection must apply not only to sensitive data, but also to personal information. Companies are required to collect, use, disclose, retain and delete such information in accordance with privacy policies.

Concrete Need for Action

When it comes to certification through High Knowledge, we take all of these factors into account. It is examined whether the cloud provider complies with and implements all AICPA audit criteria. To ensure that security and availability requirements are always guaranteed, cloud providers must certify their services at regular intervals. This also includes a strict audit procedure. This ensures that detailed records are kept at all times about the use of personal data and other sensitive information.

Contact us!