SOC 2 Compliance

• Review of Current Controls: Our team of experts will review the current controls you have implemented to ensure the security, availability confidentiality, processing integrity, and privacy (known collectively as Trust Service Criteria or TSC) of your existing data assets.

• Assessment of Controls: Controls are assessed for effectiveness and documented beside the applicable key performance indicators. The results will indicate the quickest route to a successful audit.

At a minimum, SOC 2 reports must include the Security or Common Criteria — any other TSCs selected will depend on your business requirements.

The Trust Services Criteria are selected from the following:

• Security: This TSC ensures protection against unauthorised access, encompassing both physical and logical security. It examines aspects like logical access to critical infrastructure, such as source code repositories, and covers elements like password parameters, network device configurations, firewalls, and physical security measures safeguarding key infrastructure.
• Availability: Here, the focus is on ensuring that the system is accessible and operational as intended and agreed upon. Compliance with availability criteria necessitates documented business continuity and disaster recovery plans and procedures. It also involves regular backups and recovery testing.
• Confidentiality: This criterion safeguards information marked as ‘Confidential’ as per policy or agreement. It’s important to note that confidentiality criteria are distinct from privacy criteria. They apply to the protection of confidential data, including intellectual property and shared information from business partners.
• Processing Integrity: This TSC ensures that system processing is complete, accurate, and authorised. Processing integrity isn’t as frequently addressed as availability and confidentiality TSCs and typically applies to systems involved in transaction processing, like payment systems.
• Privacy: The privacy criteria come into play when handling ‘personal information’ within the system. It’s crucial to differentiate privacy criteria from confidentiality criteria, as the former is concerned with personal data, while the latter pertains to other types of sensitive information.

Once the TSC selection and Confirmation have been completed, we’ll work with your organisation to proceed with the following;

• Mapping Controls: Document the policy reference, relevant SOC 2 Trust Services Criteria (TSC), the implemented control, its purpose, key performance metrics, and testing procedures to assess its ongoing effectiveness.
• Provide Evidence: Clearly illustrate how policies relate to testing provide concrete evidence of SOC 2 TSC compliance, streamlining the Auditor’s work and supplying crucial report data.

Assessment and Remediation: Where controls are insufficient or not present to demonstrate compliance to a selected TSC, we’ll recommend cost-effective remedial actions to ‘fill the gap’ and demonstrate compliance. We’ll also recommend controls that are most effective in the people, process, or technology.

Upon completion of the first four steps, we’ll conduct a workshop with your business stakeholders to ensure their understanding of the findings and SOC 2 compliance requirements. The workshop seeks to guide attendees through the steps required to obtain a favourable Type 1, SOC 2 Report.