SOC 2: Assessment and Audit Preparation
According to a survey by the Federal Statistical Office, the number of people working from home for their company doubled from 12.8 percent in 2019 to 24.8 percent in 2021. One of the main reasons was the corona pandemic.
The Work-From-Home Revolution
Distributed workplaces need reliable access to applications and data. A SOC 2 report can give customers and business partners clear information on a service provider's assessed controls. Its significance depends on scope, report type and the period examined. It does not provide a blanket guarantee of cloud security.
What Does SOC 2 Stand for?
SOC stands for System and Organization Controls. It addresses controls and procedures within an organisation, including protection against unauthorised access, alteration and use. The American Institute of Certified Public Accountants (AICPA) publishes the SOC reporting framework and associated Trust Services Criteria used in these engagements.
This includes:
- SOC 1 — SOC for Service Organizations: Tipp: Internal Control over Financial Reporting (ICFR)
- SOC 2 — SOC for Service Organizations: Trust Services Criteria
- SOC 3 —SOC for Service Organizations: Trust Services Criteria for General Use Report
- SOC for Cybersecurity
- SOC for Supply Chain
SOC 2 provides a framework for examining controls at service organisations. The relevant Trust Services Criteria address areas such as security and privacy in cloud services.
The Trust Services Criteria are:
Security:
Availability:
Integrity:
Confidentiality:
Privacy Policy:
Concrete Need for Action
High Knowledge supports preparation for a SOC 2 examination against the agreed Trust Services Criteria. We organise existing controls, evidence and outstanding actions. The SOC 2 report is issued by an authorised independent accountancy firm. This includes a rigorous audit process. The report describes the controls examined within the defined scope; a Type 2 report also assesses their operating effectiveness over the agreed period.
