System and Organization Controls

Trust Services Criteria were designed such that they can provide flexibility in application to better suit the unique controls implemented by an organization to address its unique risks and threats it faces. This is in contrast to other control frameworks that mandate specific controls whether applicable or not. Trust Services Criteria application in actual situations requires judgement as to suitability. The Trust Services Criteria are used when "evaluating the suitability of the design and operating effectiveness of controls relevant to the security, availability, processing integrity, confidentiality or privacy of information and systems used to provide product or services" – AICPA – ASEC. Organization of the Trust Services Criteria are aligned to the COSO framework's 17 principles with additional supplemental criteria organized into logical and physical access controls, system operations, change management and risk mitigation. Further, the additional supplemental criteria are shared among the Trust Services Criteria – Common Criteria (CC) and additional specific criteria for availability, processing integrity, confidentiality and privacy. Common criteria are labeled as, Control environment (CC1.x), Information and communication (CC2.x), Risk assessment (CC3.x), Monitoring of controls (CC4.x) and Control activities related to the design and implementation of controls (CC5.x). Common criteria are suitable and complete for evaluation security criteria. However, there additional category specific criteria for Availability (A.x), Processing integrity (PI.x), Confidentiality (C.x) and Privacy (P.x). Criteria for each trust services categories addressed in an engagement are considered complete when all criterial associated with that category are addressed. SOC 2 reports focus on controls addressed by five semi-overlapping categories called Trust Service Criteria which also support the CIA triad of information security: • Security – information and systems are protected against unauthorized access and disclosure, and damage to the system that could compromise the availability, confidentiality, integrity and privacy of the system. • Firewalls • Intrusion detection • Multi-factor authentication • Availability – information and systems are available for operational use. • Performance monitoring • Disaster recovery • Incident handling • Confidentiality – information is protected and available on a legitimate need to know basis. Applies to various types of sensitive information. • Encryption • Access controls • Firewalls • Processing Integrity – system processing is complete, valid, accurate, timely and authorized. • Quality assurance • Process monitoring • Adherence to principle • Privacy – personal information is collected, used, retained, disclosed and disposed according to policy. Privacy applies only to personal information. • Access control • Multi-factor authentication • Encryption ==Reporting==

Levels There are two levels of SOC reports which are also specified by SSAE 18: • Type 1, which describes a service organization's systems and whether the design of specified controls meet the relevant trust principles. (Are the design and documentation likely to accomplish the goals defined in the report?) • Type 2, which also addresses the operational effectiveness of the specified controls over a period of time (usually 9 to 12 months). (Is the implementation appropriate?) Types There are three types of SOC reports. • SOC 1 – Internal Control over Financial Reporting (ICFR) • SOC 2 – Trust Services Criteria • SOC 3 – Trust Services Criteria for General Use Report Additionally, there are specialized SOC reports for Cybersecurity and Supply Chain. SOC 1 and SOC 2 reports are intended for a limited audience – specifically, users with an adequate understanding of the system in question. SOC 3 reports contain less specific information and can be distributed to the general public. Audits Only licensed CPA firms or audit firms certified to perform SOC assessments can conduct your SOC 2 audit. These auditors must be independent and adhere to AICPA standards. The SOC 2 Audit provides the organization's detailed internal controls report made in compliance with the five trust service criteria. It demonstrates how well the organization safeguards customer data and reassures customers that it provides services securely and reliably. SOC 2 reports are therefore intended to be made available only to customers and other stakeholders. A SOC 2 Readiness Assessment is a critical step before the audit. It helps identify gaps in controls, documentation, or evidence early, reducing surprises during the audit. Strong preparation includes completing documentation, validating system configurations, involving cross-functional teams, and ensuring continuous monitoring. == See also ==