SOC 2 Requirements Checklist with IT Managed Services

A System Organization Controls (SOC) Audit is an important standard and regulation that every service provider must adhere to. If your organization stores or transmits potentially sensitive data on behalf of clients, earning a SOC 2 certification isn’t just a legal necessity, but a crucial competitive advantage in a time when service reliability and information security are at the top of people’s minds.

What is a SOC 2 Type 2 report?

While the SOC standard was originally introduced for accountants and finance departments, it now applies to every business in the service sector that stores customer data. That said, the SOC 2 Type 2 requirements checklist offers more flexibility than standards such as NIST or HIPAA, making it easier to adapt to specific business needs and environments.

Both SOC Type 1 and Type 2 reports are similar, save for one important difference. A Type 1 report evaluates your infrastructure at a given point in time, while a Type 2 report analyzes its performance over a period of at least six months. Thus, a Type 2 report provides a deeper overview of your infrastructure, but it also takes more preparation and costs more money.

Both report types cover five areas known as Trust Services Criteria, each of which provides a set of controls and recommendations. There’s significant overlap in some areas, but following these criteria will help ensure you don’t miss anything, while also helping you align your strategy to the priorities of your clients.

SOC 2 Requirements Checklist & Trust Principles

1. Security

Information security is the overarching purpose of the SOC 2 standards. Your systems must be able to prevent unauthorized access to sensitive data that’s either in transit or at rest. Good, proven measures to ensure a high standard of security include data encryption, multi-factor authentication (MFA), and constant monitoring.

Security controls must exist at both the front and back end of your information systems. From the front end, a strong password policy, backed up by MFA, will help keep accounts belonging to customers and employees safe. From the back end, you need to implement measures like intrusion detection and prevention and firewalls.

2. Availability

When it comes to managed services, the service level agreement (SLA) is the most important document a customer will ever sign. This contract defines essential parameters, such as the minimum amount of availability of the service and the maximum amount of time to answer any customer support requests.

SOC 2 compliance must align with your SLAs to ensure a high level of availability for all systems responsible for securing confidential customer data. This can be helped by ongoing service monitoring and cloud backup & disaster recovery, complete with automated rollovers in case the primary system fails.

3. Processing Integrity

There’s a significant amount of overlap between processing integrity and availability in that it determines the reliability of your information security systems. The processing of security-related data, such as event logs, must be complete, timely, and accurate, as well as aligned with organizational objectives.

Ongoing, round-the-clock monitoring is naturally an essential part of meeting the demands of the processing integrity criteria. With real-time, data-driven insights, organizations can protect against cyber threats and other issues proactively. With financial transactions, it shows clients that their transactions are complete, valid, and accurate.

4. Confidentiality

As a service provider, you need to know who has access to your and your client's data, and how it's stored and transmitted to other parties. Again, there’s a high degree of crossover with the other trust services criteria, but confidentiality focuses more on how sensitive information is kept private, rather than the right to privacy itself.

Data encryption is the single most important factor when it comes to ensuring confidentiality. Even if an outsider manages to intercept sensitive data at rest or in transit, encryption will ensure that it remains useless to them. Finally, you need to categorize information on the basis of its sensitivity level, as this will help you determine which security protocols to apply.

5. Privacy

With the rise of surveillance capitalism, it’s hardly surprising that privacy has become a major concern for both consumers and business customers. Here, 'privacy' refers to the right people have to decide who has access to information pertaining to them, how they want to use it, and what they want to use it for. Privacy should be ensured by design and default, per regulations like GDPR or CCPA.

Clients should be afforded full control over which information they divulge, and which controls are in place to protect it. Again, using data encryption and MFA can help customers protect their privacy. Service providers must be completely transparent about which information they collect and why, as per the criteria set out in the generally accepted privacy principles (GAPP).

Editor's Note: This post was originally published in January 2021 and has been updated for accuracy and comprehensiveness.

Charles IT provides third-party auditing to ensure your business is able to uphold compliance and information security today, and tomorrow. Get in touch today to schedule an assessment!