By now, if you’re a SaaS vendor that serves enterprise clients, you’ve likely heard about SOC 2. Today’s enterprises are under more scrutiny than ever from regulators and customers alike. Why? Because they handle, store, and process large amounts of customer data that could be compromised in the case of a breach. 

SOC 2 is a framework that provides criteria for how companies can and should manage customer data based on security, privacy, confidentiality, availability, and processing integrity. Enterprises that operate on the cloud have largely been mandated to be SOC 2 compliant — and that means that they’re now looking for the same levels of security and privacy from their SaaS vendors. 

To provide a little more clarity on what SOC 2 is and how it works, we’ve put together some of the key details for you below.

Audit types

Before diving into the SOC framework, it is important to understand the three different types of audits your company can perform:

• Internal: Run internally by your team, it is put in place to measure and control internal standards and processes.
• External second: Run by another company — such as a client — to ensure that your company is meeting the requirements specified in the contract.
• External third party: Run by an independent auditing company to validate that your company is conforming to a set of standards, such as the SOC standards.

What’s great about third-party audits is that they allow you to privately distribute a report to prospects and customers. It also enables you to add a logo to your website, proving compliance with industry standards.

Understanding the SOC framework

Now that we’ve addressed that, let’s take a closer look at the framework itself. 

What it is

SOC, which stands for Service Organization Control, is a reporting framework. As such, at the end of a third-party audit, companies are granted with a report that outlines their level of compliance and are the result of auditing standards followed by the auditors.

Who is in charge? 

The American Institute of CPAs (AICPA) is in charge of designing and maintaining the SOC framework. It is updated regularly to adjust to the fast-moving industry.

Differences between SOC 1 and SOC 2

Both SOC 1 and SOC 2 audits exist to validate the controls in place at your company and let your clients know that you are following industry standards.

SOC 1 is used to audit the controls relevant to your company’s finances.

SOC 2 is used to audit the controls relevant to the security, availability, or processing integrity of either a system you are running, or the information the system processes.

Differences between Type 1 and Type 2

Both SOC 1 and SOC 2 reports exist in two flavors:

Type 1: This is a point-in-time audit, during which auditors evaluate and report on the design of controls your company put into place as of a point in time. This is a great way to show good faith to your customers.

‍Type 2: This happens over a period of time. This type of audit follows a Type 1 audit and is what your larger customers will be after. Auditors usually recommend taking between four and six months for the first audit, and between six to 12 months for consequent audits. It is important to note that there are no requirements or standards for the audit duration other than a three-month minimum.

At the end of the audit period, auditors will come on-site and review the controls put in place during the Type 1 audit. For a Type 2 audit, however, auditors will ask for historical data. This is how you show your clients and customers that you are continuously following industry standards.

As an example, let's assume that you have a procedure in place to revoke access to a terminated employee:

• During a Type 1 audit, auditors will review this policy and make sure it conforms to the SOC 2 standard.
• During a Type 2 audit, the auditors will ask you for a list of all employees who left during the audit period and look for proof that you followed the policy in each instance.

Do I need a SOC 2 report? 

If your company offers a SaaS solution, a SOC 2 report will prove to your clients that you are handling their data safely by following trusted industry standards. It will make the difference between you and your competitors. Starting with a SOC 2 Type 1 report is a great first step to understanding the technicalities of the audit before moving to the SOC 2 Type 2 cycle.

If you are interested in hearing more or have any questions regarding SOC 2 audits, contact us. We specialize in assisting companies prepare for SOC 2 audits and want to help you make the process smoother and faster.