SOC 2 Certification
SOC 2 (System and Organization Controls 2) is a set of standards developed by the American Institute of CPAs (AICPA) for managing client data based on five “trust service principles”: security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports assure customers, stakeholders, and regulators that effective controls are in place to protect sensitive data.
SOC reports are classified into two types:
Type I specifies a vendor’s systems and whether their design meets applicable trust principles.
Type II describes the systems’ operational efficacy.
What we do
RNR enables you to achieve SOC2 compliance considerably faster and at a lower cost than any other manual solution. RNR makes sure to reduce unnecessary delays by automating evidence collecting, accelerating the process with the assistance of a SaaS checklist, and we make everything much more transparent.
Empower Your Saleswith the SOC 2 Certification
Why SOC 2? It’s the Report Your Customers Want to See
SOC 2 is a valuable tool for selling your SaaS solution to enterprise customers.
Providing a SOC 2 report streamlines your sales process. Without a SOC 2 report, each one of your customers (or potential customers) may have to commission their own audit of your service before they can buy it, and then repeat that audit annually. That’s not only a big commitment to make before a purchase, it’s also a huge burden for the service provider to support audit after audit, indefinitely.
With a SOC 2 report in hand, you’re removing that security compliance hurdle for anyone considering your service.
Focus on your business while RNR takes end-to-end charge of your IT audits.
The Process includes the five trust service principles of SOC 2
- Availability
- Confidentiality
- Processing Integrity
- Privacy
- Security
Understanding the SOC 2 Certification Process
The Five Trust Services Principles of SOC 2
A SOC 2 audit can only be performed by a CPA. At their core, these audits gauge how the service delivery of a system fulfill the selected trust principles of SOC 2.
Availability
The process, product, or service must remain available per the agreement between user and provider. Both parties either explicitly or implicitly agree on the appropriate level of availability of the service. A system need not be evaluated for efficiency or accessibility to meet the trust principle of availability. To audit availability, an auditor must consider the reliability and quality of the network, response to security incidents and site failover.
Confidentiality
If access to the data is limited to certain individuals or organizations, it must be treated as confidential. Data protected by the principle of confidentiality could include anything the user submits for the eyes of company employees only, including but not limited to business plans, internal price lists, intellectual property and other forms of financial information. An auditor will take into account data encryption, network firewalls, software firewalls and access controls.
Processing Integrity
System processing is complete, valid, accurate, timely, and authorized to meet business objectives.
Privacy
The principle of privacy applies to the collection, disclosure, disposal, storage and use of personal information with regard to the generally accepted principles of privacy (GAPP) as established by the AICPA. It applies to Personal Identifiable Information (PII), information that can be used to differentiate persons, including but not limited to names, addresses, phone numbers and social security numbers. Other data, including race, gender, medical profiles, and religion are also covered by GAPP. An auditor must verify controls in place to prevent the dissemination of PII.
Security
System resources must be defended against outside access to comply with the principle of security. Access controls must adequately resist attempts at intrusion, device manipulation, unauthorized deletion, data misuse, or improper modification and release. An auditor looks at IT security tools like WAF (web application firewalls), encryption and intrusion detection in addition to administrative controls such as background checks and authorizations.
Leave us message