SOC reports simplified with our top 10 questions and answers
One of the most popular frameworks we get questions about is the SOC 2 report. Companies often get an unexpected request from a customer or prospect who is seeking verification of their data security and risk management programs, specifically with a request for a SOC 2 Type I or Type II report. These audits are a great way to show that you take information security seriously - but what does it entail and how do you get one? At Ostendio, we help customers every day prepare and undergo audits related to SOC 2 Type I and Type II as well as SOC 3, so here are our top 10 questions and answers about SOC reports.
We’ve got you covered with all you need to know about SOC audits. Here are the top 10 questions and answers about SOC reports:
The AICPA (American Institute of CPAs) created the SOC (Service Organizational Controls) framework to cater to the growing trend of outsourcing business operations. This framework provides guidance on standards that should be used for reports covering operational and technological business risks – not just financial controls as was the case before the SOC framework. SOC reports can be applied to virtually any industry or business sector.
By completing a SOC 2 Type II audit, you will be able to share with customers the steps you have taken to protect sensitive data and show that you have an established information security program.
SOC 2 reports are specifically designed to report on the controls that make up the Trust Services Criteria. The Trust Services Criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy.
In summary here’s an overview of each:
SOC 1 is a report that’s financially focused and not able to verify at the level of big security, operations, and data compliance. It’s an audit of the internal controls at a service organization that’s relevant to financial reporting (ICFR). These reports are intended for auditor-to-auditor communication.
SOC 2 reports are specifically designed to report on the controls that make up the 5 categories of the Trust Services Criteria. SOC 2 reports demonstrate that, at a particular moment in time, everything is correct and compliant and is, therefore, a report that’s recurring. They can be shared with customers, management, regulators, and third parties. As they contain sensitive information, a Non-Disclosure Agreement may be necessary before sharing.
SOC 3 reports also focus on the Trust Services Criteria controls. However, unlike SOC 2 reports, SOC 3 reports are certified and can be widely shared. They’re considered “General Use” reports and offer a less detailed summary of the information. The same information as in a SOC 2 report needs to be considered, so it’s not uncommon for organizations to do a SOC 2 and then have the auditors write the SOC 3 summarizing the SOC 2 report.
It typically takes anywhere from 1 to 2 months to prepare for the audit but this assumes your security program is mature and already meets most of the SOC 2 criteria. If you have significant gaps in your security program then it can take longer. The audit process usually follows an approach of planning, fieldwork, and reporting.
There is no set cost for a SOC 2 audit. It will depend on several factors including:
Remember, this is an annual recurring report, so the upfront cost is always higher. You can expect costs to lower by 10 - 20% in subsequent years. That said, we typically advise customers to budget up to 6 figures for the total cost of achieving SOC compliance. This includes your internal costs for time invested, preparation costs, the cost of the audits itself, and incremental technology costs required to meet security requirements and possibly support the process.
Qualified auditors will complete the SOC audit. They must be AICPA certified auditors.
[Learn more by reading our blog post “How to choose an auditor: 6 questions to ask”]
You can easily find a qualified auditor through the Ostendio MyVCM Auditor Connect feature. This ensures that the auditor you choose will also be using the Ostendio MyVCM platform. This will save you time and money when completing an audit. By sharing evidence in the Ostendio MyVCM platform you will eliminate the need to email spreadsheets and documents and find it easier to keep track of how your audit is progressing. The auditor can also communicate with the client through the platform to ask for clarification if necessary. Auditors and customers have found that using the Ostendio MyVCM platform for a SOC audit can cut time and cost by over 50%.
Many Ostendio customers use the Ostendio Professional Services team of experts for additional help during the preparation of a SOC audit. They can help you understand the scope of your SOC 2 audit, prepare documentation and policies, collect evidence and help you choose the right auditor for your company. In addition, the advantage of a platform like Ostendio MyVCM is that it performs much of the heavy lifting for you i.e. tracking activity, scheduling reminders, and performing follow-up.
Get advice from an experienced SOC preparer
And finally, a valuable piece of advice we give all customers: Document, document, document! We can’t stress this enough. Everything needs to be documented and tracked. If you didn’t record it, it didn’t happen in the eyes of an auditor. Ostendio MyVCM significantly eases the collection, management, and mapping of evidence across all required controls. Evidence is kept current ensuring it is always up to date, and all communications, changes, and mitigations are fully tracked and stored within the Ostendio MyVCM platform. This will make life so much easier when you start preparing for your SOC 2 audit. As an experienced SOC 2 preparer, we can provide a better estimate about cost and timing after a scoping discussion.
If you are ready to get started or just want to find out more, contact an expert at Ostendio who is happy to talk about your organization’s data security needs. They can also give you a quick tour of the Ostendio MyVCM platform so you can see how easy it is to use for your SOC journey.
Read more: The Complete Guide to SOC 2