A large customer sends you a security questionnaire, and one line asks for your SOC 2 report. Your team has good security habits, but you have no report. This article explains what a SOC 2 report is, what it asks of a small business, and how to prepare for one.
What SOC 2 is
SOC 2 is a report on the controls that a service organization uses to protect its systems and its customers’ data. SOC means System and Organization Controls. An independent CPA (chartered professional accountant) firm examines your controls and gives an opinion on them. The firm uses the Trust Services Criteria, set by the American Institute of CPAs (AICPA).
A SOC 2 report is an attestation report, not a certificate. The report holds three main parts: your description of the system, your written assertion about your controls, and the auditor’s opinion on both.
Think of a home inspection before a sale. The buyer does not take your word that the roof is sound. An independent inspector checks it and writes down the findings. A SOC 2 report plays the same part between you and your customer.
A SOC 3 report covers the same ground, but it is written for general use, so you can publish it. Use of a SOC 2 report is restricted to readers who understand your service, such as customers and business partners.
Why it matters for an SMB
If you sell a service that touches customer data, such as software, hosting or managed IT, your business customers carry risk through you. The AICPA notes that customers and business partners often ask a service organization for a SOC 2 report. Prospects can also use it when they choose a supplier.
A questionnaire gives a customer your own answers. A SOC 2 report gives the customer an independent opinion.
In Canada, there is no separate Canadian SOC 2 standard. A Canadian CPA firm performs the engagement under CSAE 3000, the Canadian standard for attestation engagements, with the AICPA Trust Services Criteria. A firm can also report under both Canadian and U.S. standards when the readers are in both markets. CPA Canada publishes a SOC 2 guide for Canadian practitioners.
SOC 2 is voluntary. A SOC 2 report does not prove, on its own, that you meet Law 25 or PIPEDA. It shows how your controls work against one set of criteria.
What it asks for
The five categories
The Trust Services Criteria group the controls into five categories:
- Security: information and systems are protected against unauthorized access, unauthorized disclosure and damage.
- Availability: information and systems are available for operation and use to meet your objectives.
- Processing integrity: system processing is complete, valid, accurate, timely and authorized.
- Confidentiality: information designated as confidential is protected.
- Privacy: personal information is collected, used, retained, disclosed and disposed of to meet your objectives.
Security is in scope in most SOC 2 reports. Its criteria, called the common criteria, also apply to each of the other four categories. Add another category only when a commitment to your customers calls for it. For example, add availability if your contracts promise uptime.
The criteria in use are the 2017 Trust Services Criteria, with points of focus revised in 2022. The 2022 revision changed the points of focus, not the criteria. Points of focus describe important characteristics of a criterion, and you do not have to address each one.
Type I and Type II
A Type I report looks at one date. It checks that your system description is accurate and that your controls were suitably designed on that date.
A Type II report covers a period of time. It also tests whether the controls operated effectively throughout that period, and it lists the auditor’s tests and their results. A Type II report tells a reader more, because it shows how the controls worked over time.
The AICPA guide sets no fixed length for the period. Its own example says that a period shorter than two months is unlikely to give the auditor enough evidence.
Scope and the system description
You write the description of the system under review. It can follow the parts of the system: infrastructure, software, people, data, and processes and procedures. Its boundaries must be clear, so that readers know which services and teams the report covers.
If a cloud host runs part of your system, the description says whether the report includes the host’s controls or leaves them out.
The controls the auditor tests
The common criteria cover your control environment, communication, risk assessment, monitoring and control activities. In practice, a small business needs:
- Written policies and procedures that put the controls into action.
- Access control: approve each account before it gets access, remove access when it is no longer needed, and give each person only the access the job needs.
- Change management: approve, test and document changes before they go live.
- Monitoring: watch your systems for anomalies and evaluate each security event.
- Incident response: a defined process to contain, fix and communicate security incidents.
- Vendor management: assess and manage the risks that come from your vendors and business partners.
- Evidence: dated records that show each control ran.
How to approach it
- Ask the customer what it needs. Confirm the report, the categories, the type and the deadline.
- Set the scope. Pick the service your customers buy, and start with the security category.
- Run a readiness assessment. Compare your current controls with the criteria and list the gaps.
- Close the gaps. Write the missing policies, and give each control an owner.
- Collect evidence as you go. Store each record with the control it supports, and date it.
- Choose a CPA firm. In Canada, ask whether the firm reports under CSAE 3000, U.S. standards, or both.
- Keep the controls running after the report. A report covers a past date or period, and customers may ask for a newer one later.
Common mistakes
- Calling SOC 2 a certification. It is an auditor’s opinion on a defined scope.
- Adding every category at once. Start with what your customers ask for.
- Writing policies that nobody follows. The auditor tests what people do.
- Collecting evidence at the end of the period. A record you never kept cannot be made later.
- Forgetting your suppliers. Read the scope of your cloud host’s own report.
- Treating a SOC 2 report as proof that you meet Law 25.
- Letting controls lapse after the report arrives.
Good to know: This article is general information, not professional advice. For your own SOC 2 examination, speak with a qualified CPA firm.
How NextIT helps
NextIT helps you prepare for your SOC 2 examination. You add SOC 2 to the frameworks you follow, and the compliance assessment shows your score for each one. Control Management and Evidence Repository link each piece of evidence to its controls and track its expiry date. The Vendors module keeps your vendor register, and the Security Incident Register follows each incident to a post-incident review. You can give an outside auditor read-only access for the length of the review. The Compliance report exports your SOC 2 results as a PDF. To see how this fits your business, book a demo.