SOC 2 Archives

SOC 2 Type 2 Audit for SaaS Companies

Explore the SOC 2 Type 2 audit process, readiness tips, cost of SOC 2 certification and frequency of SOC 2 certification for SaaS Companies

Getting a SOC 2 Type II Report can be a game-changer for a SaaS Company. It can transform how you respond to RFQs and how you assure potential leads that your systems are secure. Most SaaS companies view the cost of a SOC 2 Certification / Examination as an investment in their future revenue. They plan meticulously to succeed in their SOC 2 audit and stay certified.

A SOC 2 audit is conducted by an authorized CPA firm or SOC 2 auditor that you select. During your SOC 2 audit, they assess the design and performance of your internal controls at a point in time or over a defined number of months. During the audit period they take a sample to test the end-to-end performance of these controls and report their findings. The results of the audit and the effectiveness of the controls are outlined in the SOC 2 audit report. This helps clients and business partners understand which Trust Services Criteria your systems adhere to. By staying SOC 2 certified, you can continue to assure stakeholders of the value of working with your company.

Preparing for your SOC 2 audit

SaaS companies begin preparing for their SOC 2 audit by implementing the internal controls that are important to their clients. They gather evidence and documentation and look for a SOC 2 auditor who understands their industry and customer requirements. One way to verify the authenticity of the CPA Firm / SOC 2 auditor is by checking the AICPA’s Public File Search.

As you prepare for your SOC 2 Type II audit or during the audit itself, you may face challenges with their SOC 2 auditor that can be avoided. One such confusion is with regards to the Trust Services Criteria.

Are you expected to follow all the Trust Services Criteria?

AICPA has outlined 5 Trust Services Criteria as part of the SOC 2 framework – Security, Availability, Confidentiality, Privacy and Processing Integrity. However, any organization that wants to get SOC 2 certified, is allowed to select the criteria they want and implement the respective internal controls. During the SOC 2 audit, your auditor is only expected to review the criteria that you have selected. They cannot ask you to comply with more criteria than the one(s) you have selected.

Typically, a SaaS company may choose to implement the follow Trust Services criteria:

Security: This focuses on protecting information and all systems from unauthorized access.
Availability: This focuses on the resiliency of the infrastructure, information and software.
Confidentiality: This refers to the company’ ability to restrict access and ensure that data is disclosed only to authorized personnel or organizations.

They may also choose to implement certain controls under the remaining 2 criteria if their clients require it.

Privacy: This addresses the organization’ ability to protect Personally Identifiable Information (PII) and ensure that it cannot be used to identify any individual. Privacy as a TSC, is primarily essential for Direct to Consumer engagement.
Processing integrity: This verifies if the systems achieve their purpose – the delivery of complete and accurate data, within the correct timeframe and level of access.

What happens in a SOC 2 audit of a SaaS company?

A SOC 2 audit only begins when all the controls are in place and all aspects of information security are performing as designed. To check their level of preparedness, SaaS companies may opt for a SOC 2 Readiness Assessment. This can be a failsafe option since all the controls are tested and evidence is systematically organized and checked by a consultant. You get an opportunity to plug the gaps, complete your evidence collection and begin writing the ‘Management’ Assertion’. This section is submitted by the company to the SOC 2 auditor and included in your SOC 2 Report. During this time, you can also vet potential SOC 2 auditors and finalize the scope of your engagement.

Once you select your auditor, discuss your engagement and finalize your scope, the audit period begins on the date decided by the SOC 2 auditor. The first SOC 2 examination period is usually 3-6 months. The company cannot modify any process during the audit period. The start date of a SOC 2 audit is in the future, and it is shared with the CPA firm. Performance evaluated outside of the SOC 2 audit period cannot influence or be part of the SOC 2 report.

The audit period begins with the auditors collecting evidence for all the controls and for some controls with populations, selecting a random sample from a population of data, based on AICPA Guidelines and scientific sampling principles. During the SOC 2 audit, auditors observe security controls in action as they relate to the random sample. The company is expected to showcase evidence and confirm that all the controls have been designed and implemented per intent. If controls are implemented correctly and the company is SOC 2 ready, customer data is protected, and no violation is observed. The absence of activity during the audit is a sign of success since it implies that all aspects of data protection are in place. The testing of the controls starts immediately after the audit period ends. The sample’s test results are included in the SOC 2 report.

How is a SOC 2 Type II audit different for a SaaS Company?

Physical security controls may not be applicable for a SOC 2 certification / examination of a SaaS company because the tech infrastructure is hosted with a Cloud Service Provider. Since SaaS companies outsource it to a 3rd party, they are responsible for it. As a result, an on-site audit may also be optional for a SaaS company.

Your SOC 2 audit might also include reviewing the SOC 2 reports of your vendors and partners. Your SOC 2 auditor might verify and validate CUECs of your vendors as well.

How regularly are you required to perform a SOC 2 audit?

A SOC 2 report is valid for 12 months. SOC 2 audits are conducted every 12 -18 months to help you stay certified. You reserve the right to change your SOC 2 auditor after every engagement and modify the Trust Services Criteria during each SOC 2 audit. In our experience as SOC 2 Readiness Assessment consultants, we have observed that SaaS companies usually add additional controls and criteria while continuing to implement previous controls. They also tend to improve in the way they structure and gather evidence to reduce the amount of time and effort during each SOC 2 audit.

What is the cost of a SOC 2 Certification / Examination?

The cost of a SOC 2 certification can be divided into 2 sections:

Cost of SOC 2 Readiness Assessment: Consultants who specialize in preparing firms for SOC 2 can help you design /implement new controls, draft and implement policies and procedures, provide customized staff training, review your evidence documents and help you draft the ‘Management’ Assertion’. They can also help you streamline the Complementary User Entity Controls (CUECs) that your customers will need to have in place to use your services properly. Some examples of CUECs are password complexities, time out parameters and MFA. These have to be set up by the customer, not necessarily the SaaS company. The client and SaaS company have shared a responsibility to ensure security. The SaaS company is responsible for defining CUECs clearly and your customer is responsible for implementing them.

Working with a SOC 2 readiness partner who has previous experience in your industry can also help you streamline the Trust Services Criteria that will be important to your clients. This will help you plug any gaps and not only help you prepare for your SOC 2 audit but also for the RFQs where you will include your SOC 2 Report. A typical SOC 2 engagement for readiness could cost anywhere from USD 10,000 – 50,000.

Cost of SOC 2 Certification / Examination: A SOC 2 examination by a CPA firm could cost anywhere from USD 15,000 – 30,000 depending on the trust services criteria you select. However, the price should not be the predominant factor that influences your decision. A SOC 2 auditor who understands your industry will be able to clearly mention the Complementary User Entity Controls (CUECs) in the SOC 2 Report. These controls are intended for your customer – the actual consumer of the SOC 2 report. They inform your customer about the controls they need to implement in their systems to properly use your services. You also need to read the fine print that is part of the engagement contract and ensure that you are not legally obligated to work with the same SOC 2 auditor or authorized CPA firm for the next few years.

The ideal SOC 2 auditor is the one who respects your selection of the Trust Services Criteria, understands what your customer’s need to know and ensures that your scope is clearly mapped before the engagement begins. You can review some recommendations to help you avoid challenges you may face with a SOC 2 auditor.

How databrackets can support your SOC 2 Journey ?

Experts at databrackets have extensive experience in supporting organizations that align their processes with AICPA’s Trust Services Criteria and prepare for a SOC 2 Audit. If you would like to connect with an expert to better understand SOC 2 and plan your SOC 2 journey, do not hesitate to schedule a consultation.

Challenges you may face with a SOC 2 auditor

Explore some challenges you may face with your SOC 2 auditor and discover ways to avoid them

A SOC 2 certification / examination is pursued by service organizations who want to prove to potential customers that they can manage their data effectively. Typically a SaaS provider, Managed Service Provider (MSP), Network service provider and other service providers select an authorized CPA firm and an authorized SOC 2 auditor in it, to audit their system. Usually, the process may be smooth if they go through a readiness prep assessment and then select a SOC 2 auditor who is familiar with their industry and customer requirements. However, sometimes, you may find yourself in a difficult situation during your SOC 2 audit and you may want to consider changing your SOC 2 auditor.

A SOC 2 examination can be time consuming, and you can exceed your budget if it is not systematically planned. Sometimes, the challenges may arise from within the company and can lead to a blame game with the auditor. We highly recommend undergoing a SOC 2 readiness assessment, getting organized and vetting your SOC 2 auditor, to avoid such an occurrence.

Challenges you may face with a SOC 2 auditor:

1) Lack of engagement overview & scope analysis

Your SOC 2 audit can be a relatively seamless experience when your evidence matches the SOC 2 controls and the Trust Services Criteria you want audited. After you agree on the scope of the audit and your customer requirements, it is up to the SOC 2 auditor to discuss all the steps involved and the evidence that you will be required to submit. If the scoping is not clearly defined at the start, the auditor can go out of scope. This can be particularly confusing for companies who are new to SOC 2 and who need a proper orientation to the process. The process has to be matured and you need to gauge the process maturity of the CPA firm before finalizing your contract to work with them.

SOC 2 audits need to be conducted annually. As a result some CPA Firms also mandate the continuity of work for 3-5 years in their contracts. The SOC 2 framework and AICPA does not mandate continuing with the same SOC 2 auditor after you complete your engagement. This is yet another area of conflict that needs to be discussed at the outset, so you are well-informed before you sign your contract to work with the authorized CPA Firm.

There can be several pitfalls and unnecessary obstacles in your SOC 2 journey if your initial discussions are not thorough and if your auditor does not guide you properly. This is the root cause for most of the challenges you may face. We recommend that you review the rest of the challenges and draft a set of questions to vet the SOC 2 auditor before you finalize who will conduct your SOC 2 audit.

2) Time

The time spent with a SOC 2 auditor can seem excessive and hamper your ability to manage daily business operations. This can be challenging since the auditor might request a lot of information for the SOC 2 report, which you may not know is required. For example: documented proof of the management’s engagement on security issues. Proving this can involve going through several meeting documents. Audit time is not defined for a SOC 2 examination as it is for an ISO certification and this might result in unpleasant surprises for your team.

Additionally, some auditors share a spreadsheet and ask you to email evidence documents. This system can be chaotic since you need to see the correlation between the controls and the evidence / documents.

One solution we recommend is engaging the services of a SOC 2 readiness assessment partner, like databrackets, to help you get organized before your engagement with an auditor. At the outset we invite you to share your evidence on our platform as per the controls and corresponding Trust Services Criteria you have selected. This helps you to work systematically and share the evidence further with your chosen auditor. A SOC 2 readiness assessment not only helps you to save time and effort but also ensures that you have someone to check your evidence / documents and share feedback before the actual SOC 2 audit.

3) Lack of Industry Knowledge

The purpose of a SOC 2 examination / SOC 2 certification is to prove to your customers that your systems will effectively manage their data. However, at times, your SOC 2 auditor may not be familiar with your industry, day-to-day operations, SLAs and customer expectations. As a result, they may not be able to produce the kind of report that meets your customer’s expectations. This defeats the purpose of getting certified and could lead to frustration since the actual consumer of the SOC 2 report is your customer / stakeholder. If they do not get the impression that you are the right vendor for them after reading the report, the whole exercise will seem counterproductive.

Lack of industry knowledge also impacts a critical part of the report – Complementary User Entity Controls (CUECs). We have discussed this at length in the next section.

4) Unclear Complementary User Entity Controls (CUECs) in the SOC 2 Report

A customized SOC 2 report clearly outlines the Complementary User Entity Controls or CUECs in the description of the customer’s system. These controls are intended for your customer – the actual consumer of the SOC 2 report. They inform your customer about the controls they need to implement in their systems to properly use your services.

A SOC 2 auditor who is familiar with your industry can explain these CUECs in the SOC 2 Report. This is critical since the level of security, availability, privacy, confidentiality and processing integrity of your system can only be maintained when it is properly configured in the systems used by your customer. If your SOC 2 auditor does not understand your service requirements and which CUECs are critical in your industry, you may receive a SOC 2 report that does satisfy your customers and meet your objectives.

5) Selective examination of Trust Services Criteria

The SOC 2 framework permits clients to focus on the Trust Services Criteria which they want audited and exclude the rest. This flexibility exists since the SOC 2 Report outlines at the start which criteria and controls are being examined and then showcases if they function at optimal levels or not. SOC 2 allows you to select the Trust Services Criteria which you want to showcase. By using this method, the client’s customers are informed and empowered to take a decision to work with the client or not. While this is the ideal situation, if your SOC 2 auditor is unwilling to accept your decision, even when the rules permit, you may face a difficult situation. Your SOC 2 auditor may insist on an audit of all the Trust Services Criteria and not respect the flexibility accorded by the SOC 2 framework,

6) Hidden Costs and Additional Expenses

SOC 2 audits are done by authorized CPA firms who may have sister concerns or partners who offer other services which may be helpful to your company. Sometimes, your SOC 2 auditor may try to up-sell / cross sell these services aggressively, under the guise of good advice. This can lead to a conflict and unplanned expenses.

Before your SOC 2 audit, you may also be advised to undergo penetration testing to check the security of your systems. This can be yet another hidden cost, which you can predict with a SOC 2 readiness assessment.

Each of these challenges are severe and it is important to avoid the possibility of going through any of them. Through this blog, we hope that you have been empowered to foresee potential pitfalls and vet the SOC 2 auditor in the introductory meeting, ask for a sample report for your industry, review the terms of the contract you will sign and follow-up on their references before you begin your engagement.

How databrackets can support your SOC 2 Journey

Experts at databrackets have extensive experience in supporting organizations align their processes with AICPA’s Trust Services Criteria and prepare for a SOC 2 Audit. If you would like to connect with an expert to better understand SOC 2 and plan your SOC 2 journey, do not hesitate to schedule a consultation.

7 Benefits of SOC 2

Explore the benefits of being SOC 2 Certified as you begin your SOC 2 journey

A SOC 2 Report helps organizations to prove their commitment to customer data security and meet the eligibility criteria of a potential client’ RFQ. More and more clients have been asking for proof of SOC 2 Compliance while evaluating if they want to work with a vendor. This is particularly relevant for technology service providers, SaaS providers, and any organization that stores and processes customer data.

Technically, SOC 2® is not a certification. It is a report on the organization’s system and management’s internal controls relating to the Trust Services Criteria. It includes the auditor’s opinion of control efficacies on protecting data, also known as a ‘SOC 2® Attestation’.

As security partners who have worked with countless SaaS providers to prep their organization for a SOC 2 Audit, we at databrackets have observed the following 7 key benefits of SOC 2:

1. Meet regulatory requirements: Once you are SOC 2 Compliant, you are aligned with AICPA’s regulatory controls. A SOC 2 certificate is proof of that.

2. Supervise your organization: SOC 2 compliance mandates supervising all aspects of information security across all processes internally along with setting the benchmarks for vendors who manage customer data. In order to accomplish this, a robust process is designed, and its effectiveness is verified once an organization is SOC 2 Certified.

3. Get a leading security certification issued by an independent 3rd party: A SOC 2 Examination is conducted by an authorized and certified CPA. This gives credibility to the process and ensures it is conducted in an objective way. As a result, it is considered to be a highly valued certification.

4. Sign new deals: You can sign more deals and increase the number of clients once you prove your ability to effectively manage customer data with a SOC 2 Certificate.

5. Assure existing customers: You can prove to your existing customers that your company not only manages their customer data with the highest level of information security, but that this has also been verified by an authorized CPA firm after a rigorous SOC 2 audit.

6. Strengthen Vendor Management: You can set the benchmarks for vendors and ensure compliance with the highest level of information security.

7. Monitor internal corporate governance and risk management processes: You can design and monitor risk management processes and internal corporate governance in accordance with the SOC 2 framework.

What is SOC 2?

Explore the basics of SOC 2 Compliance and the difference between SOC 2 Compliance and SOC 2 Certification

SOC 2 is a compliance standard for service organizations, developed by the American Institute of CPAs (AICPA). It specifies how organizations should manage customer data. The SOC 2 framework is applicable to all technology service providers or SaaS Product companies that store customer data. They are required to ensure that security controls and practices are designed and implemented effectively to safeguard the privacy and security of customer data. There are several benefits of being SOC 2 Compliance.

This security framework does not provide a specific list of controls and tools. It merely cites the criteria required to maintain a high level of information security. It is up to each organization to establish the practices and processes relevant to their own objectives and operations. SOC 2 Certification is based on 5 Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy of customer data.

Basics of SOC 2 Compliance

There are several components of becoming SOC 2 Compliant, a SOC 2 gap assessment, implementation of identified gaps, a SOC 2 audit and SOC 2 report that needs to be understood before you begin this journey. Getting SOC 2 Compliant fast is a marketing gimmick.

SOC 2 Compliance versus SOC 2 Certification

Being SOC 2 Compliant is essentially having a valid SOC 2 report by an independent third-party CPA firm. Technically, SOC 2 is not a certification – it is the auditor’s opinion of control efficacies on protecting data, also known as a ‘SOC 2 Attestation’. A SOC 2 attestation is based on the Trust Services Criteria and is provided by a registered CPA firm authorized by the AICPA. Usually, a SOC 2 report is valid for a year and the organization is required to engage the same or a different CPA firm to conduct the next SOC 2 audit.

*We would like to share that the official term is ‘SOC 2 examination’. In the industry the term ‘SOC 2 compliance’ is used interchangeably. Similarly, the official term is ‘reporting’, while the commonly used term is ‘certification’ interchangeably to help put the content into the appropriate context.

Experts at databrackets have extensive experience in supporting organizations align their processes with AICPA’s Trust Services Criteria and prepare for a SOC 2 Audit. Our unique approach to SOC 2 readiness not only brings in experts from the industry but also leverages our assessment platform to identify controls, collect the required evidence and collaborate with auditors. If you would like to connect with an expert to better understand SOC 2 and plan your SOC 2 journey, do not hesitate to schedule a consultation.

How to succeed at SOC 2

How long does it take to get SOC 2 compliant?

How databrackets prepares you to succeed at SOC 2?