SOC 2 Compliance

SOC 2 is an auditing framework that helps ensure service providers securely manage their clients’ data to protect the interests of their clients and the privacy of their customer data. SOC 2 compliance for service providers should be considered a foundational component of your information security and compliance program.

The SOC 2 standard was developed by the American Institute of CPAs (AICPA) and focuses on a core set of criteria centered on managing customer data based on the Trust Service Principles: Security, Availability, Processing Integrity, Confidentiality and Privacy.

When compared to other standards like PCI DSS, which is a very linear and structured control framework, SOC 2 reports and their control implementation are unique to each organization. Based on the focus of the system description, each organization designs its security controls to comply with the applicable trust services principles.

There are currently two types of SOC reports:

• Type I – describes a vendor’s environment and whether the security control design is suitable to meet relevant principles. (Test of Design)
• Type II – tests the operational effectiveness of those systems and their controls over a period of time. (Test of Effectiveness)

How We Can Help

Our qualified experts understand the impact regulatory requirements have on your data collection, transmission, and handling procedures. CompliancePoint brings years of experience to your organization regarding these issues.

Failure to comply with relevant requirements can have a devastating impact on your organization. Don't take chances – let our experts help! CompliancePoint has a variety of services that you can leverage to meet your privacy, security and compliance needs.