SOC 2 (System and Organization Controls 2)
SOC 2 (System and Organization Controls 2) is a type of audit report that attests to the trustworthiness of services provided by a service organization. It is commonly used to assess the risks associated with outsourced software solutions that store customer data online.
These Certifications are increasing in number by the day. Software like SecureFrame helps companies reduce costs and time to become SOC 2 certified. This type of software also provides real-time indicators of the security practices a company is following. As companies must keep their SOC 2 Type I annual audit certification in good standing.
So why is SOC 2 Certification important?
In one word: Standardization. SOC 2 ensures that an organization is using industry-standard techniques to protect their data, privacy and most importantly, the production systems their customers use. With this type of certification, RPA SaaS Providers like CampTek Software can give their customers peace of mind, knowing their practices are secure and compliant with SOC 2. Developed by the American Institute of CPAs (AICPA), SOC 2 defines criteria for
managing customer data based on five “trust service principles”—security, availability, processing integrity, confidentiality and privacy.
Here is some background on SOC 2 certification
External auditors issue SOC 2 certifications. They assess the extent to which a vendor complies with one or more of the five trust principles based on the systems and processes in place. Trust principles are broken down as follows:
Security
The security principle refers to protection of system resources against unauthorized access. Access controls help prevent potential system abuse, theft or
unauthorized removal of data, misuse of software, and improper alteration or disclosure of information. IT security tools such as network and web application firewalls (WAFs), two factor authentication and intrusion detection are useful in preventing security breaches that can lead to unauthorized access of systems and data.
Availability
The availability principle refers to the accessibility of the system, products or services as stipulated by a contract or service level agreement (SLA). As such, the minimum acceptable performance level for system availability is set by both parties. This principle does not address system functionality and usability, but does involve security-related criteria that may affect availability. Monitoring network performance and availability, site failover and security incident handling are critical in this context.
Processing integrity
The processing integrity principle addresses whether a system achieves its purpose (i.e., delivers the right data at the right price at the right time).
Accordingly, data processing must be complete, valid, accurate, timely and authorized. However, processing integrity does not necessarily imply data integrity. If data contains errors prior to being input into the system, detecting them is not usually the responsibility of the processing entity. Monitoring of data processing, coupled with quality assurance procedures, can help ensure processing integrity.
Confidentiality
Data is considered confidential if its access and disclosure is restricted to a specified set of persons or organizations. Examples may include data intended only for company personnel, as well as business plans, intellectual property, internal price lists and other types of sensitive financial information. Encryption is an important control for protecting confidentiality during transmission. Network and application firewalls, together with rigorous access controls, can be used to safeguard information being processed or stored on computer systems.
Privacy
The privacy principle addresses the system’s collection, use, retention, disclosure, and disposal of personal information in conformity with an organization’s
privacy notice, as well as with criteria set forth in the AICPA’s generally accepted privacy principles (GAPP). Personal identifiable information (PII) refers to details that can distinguish an individual (e.g., name, address, Social Security number). Some personal data related to health, race, sexuality, and religion is also considered sensitive and generally requires an extra level of protection. Putting controls in place will prevent all PII from unauthorized access.
