Blog Post
SOC 2 Type II Certification the Quick and Easy Way
- By M H
- •
- 12 Nov, 2017
- •
Save time and money by carefully navigating the SOC 2 Type II examination.
The following advice is based on real-world experience in preparing for and successfully attaining the SOC 2 Type II Report.
SOC 2 overview
The SOC II certification isn’t actually a examination. SOC 2 an external audit (SOC 2 Report) conducted by an Certified Public Accounting (CPA). There are two types of SOC 2 reports: a Type II report focuses on the suitability of the design and operating effectiveness of controls; and a Type I report focuses on the suitability of the design of controls (not effectiveness). SOC 1 focuses on the financial reporting controls (e.g. financial audit).
Used by both global technology companies such as Amazon and leading startups, the SOC 2 examination is fast becoming the industry standard for reporting on effectiveness of information security. Your goal should be complete the examination without any exceptions, demonstrating you were qualified the first time without requiring corrections.
SOC 2 examinations are administered by an independent Certified Public Accounting (CPA) firm to verify all findings are objective. Attaining the SOC 2 Type II certification may require extensive preparation, often including InfoSec program enhancements, readiness assessments or gap analysis, and preparatory mock examination(s) to collect evidence.
Pro Tip: Some organizations may only require a SOC 2 Type I Report. If a SOC 2 Type II is required, then carefully control the scope (e.g. system scope base boundaries, principle covered, and period covered). Ex: Amazon Web Services already has a SOC Report.
1. Getting organized
To get started, you will need to understand the overall architecture for your organization - the people, processes, and technologies that combine to enable your product or services. Your system should be fully inventoried and well-understood.
Organizations should create and/or update reference documentation. For example: organizational charts, network diagrams, enterprise architecture, data flow diagrams, application inventories, vendor matrix, etc. In any event, you’ll want to start with a sketch of your organization, computing centers, databases, and external/vendor IT services.
Sample of key artifacts:
- Organizational chart
- System Overview (e.g. “cartoon style” for non-technical personnel)
- Network Diagram or other technical documentation
Pro Tip: Effective security reduces simplicity. Complexity often generates vulnerabilities and increases attack vectors. Don’t overlook basics - patching, expiring legacy resources, etc.
2. Understanding your system and system boundaries
After getting organized and understanding your IT system, next you should pay special attention to the boundaries of your business and technology. Organizations often have a mix of organic IT assets (e.g. network domain controllers), vendor assets (e.g. on-promise managed services) and cloud services (e.g. SaaS services). While your organization may be responsible for all data protection, third parties are relied upon. Identify your system boundaries using IT boundaries and legal contracts. Understand your responsibilities.
Key Artifacts:
- System Overview with boundaries clearly identified (Ex: business, legal, technical)
3. Determining SOC 2 scope - selecting principles covered and the period covered
To attain the SOC 2 Type II certification the quick and easy way, you need to narrow the scope (where it makes sense) in order to minimize the amount of preparation, examination scope, and likelihood of deficiencies that could demonstrate the ineffectiveness of security services or related controls.
Consider the principles within the context of your business. For example, if you’re a software-as-a-service company, then customers are likely to want to see a SOC 2 Type II report that addresses the Security and Availability of your company’s services. If the SOC 2 is required, then the security of data/systems and the availability of cloud services is likely to be of paramount importance. So you’ll want to start with the Security Principle (at least) and you can add all or some Availability-related controls.
The scope of the SOC 2 Report is under your control, so carefully consider the business context (e.g. vendor-customer relationship), strategic imperatives (e.g. budget, timelines) and make a determination regarding which of the five principles is critically important to you.
Based on your scope, the auditor, as a member of the American Institute of Certified Public Accountants (AICPA), will apply some or all of the following Trust Services Criteria (TSC):
- Security. Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
- Availability. Information and systems are available for operation and use to meet the entity’s objectives.
- Processing integrity. System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
- Confidentiality. Information designated as confidential is protected to meet the entity’s objectives.
- Privacy. Personal information is collected, used, retained, disclosed, and disposed to meet the entity’s objectives.
The above Trust Services Criteria do overlap. Your InfoSec Program may address all of the principles listed above and the SOC 2 Report may address all of some of the principles.
As part of the SOC 2 report, your management will be required to provide the auditor with a written assertion. This "written assertion" requires management to attest the "system description” fairly presents the service organization's system, the control objectives were suitably designed to achieve those control objectives, and other standard language (e.g. the controls were constantly applied, address risk factors, etc.).
The period coverage (examination period) is another way to limit scope. The period is often 12 months (annually) but it can be as short as 3 or 6 months, especially for your initial report.
One important caveat: If you’re running mission-critical services that cannot afford any downtime, then potential customers are likely to require the Availability criteria. Or if you’re a payment processor, then potential customers are likely to require the Processing Integrity criteria. Reduce scope to a minimum, but not too much - rendering the report useless.
Pro Tip: For for your first SOC 2 Type II report, we suggest limiting the scope as much as possible. Perhaps focus on Security Criteria and a period of 6 months, not 12 months. Using this approach, you’ll have 3 months of preparation, 6 months of coverage, and then the final Report will arrive 30-60 days thereafter, so you’ll finish within one year.
4. Selecting an audit firm based on firm credibility, budget, talent, scheduling
Your company may have preferred vendors in place for the audit, however you are likely to consider the following factors in selecting the CPA firm:
- Brand Prestige: Do you require a national, regional, or local CPA firm
- Industry Qualifications: Is the firm familiar with your industry and related systems/data
- Talent Resources: Bios of members assigned to the project (experienced professionals)
- SOC Expertise: Experience authoring SOC 2 Type I and Type II reports
There is some risk the audit may become disruptive to your technology or operations teams, so be sure to ask if the audit team will be on-site, and if so, how often and how long. Some auditors are willing to author the report without any on-site visits, which can save time and prevent disruptions or scheduling conflicts among InfoSec, Tech, Ops and/or Compliance.
5. Selecting a SOC 2 readiness firm - business perspective and InfoSec expertise
CPA firms are not able to audit their own work because it presents a conflict of interest. Therefore a InfoSec advisory firm (such as CAG) is likely to handle the “readiness” or setup work and a CPA firm will perform the actual audit and issue the formal SOC 2 Report.
Engaging a firm, such as Cyber Advisory Group (CAG), to guide you through the readiness phase will ensure the actual audit goes smoothly, save time, and money since the control selection will be precise and SOC 2 Report will be on-time and without exceptions.
InfoSec expertise is critical in selecting a readiness firm. The firm must understand the many stakeholders in InfoSec - CEO goals, budget constraints, compliance necessities, engineering work styles, and overall risk-based approaches to security (e.g. cost-benefit analysis).
Pro Tip: CAG works with the big four CPA firms as well as regional and local CPA firms. CAG often recommends a regional firm since they offer the benefits of both expertise and flexibility.
6. Understand Your Assets that Require Protecting
Imagine that you’re architecting a bank. What security is required - an alarm system, video camera, man-trap doors, security guard, safe or vault? Difficult to say without understanding the types and amount of valuables that will be stored there, public access to the space, and the neighborhood. Are you designing Fort Knox or a Community Bank?
With the above in mind, you should list and attempt to quantify your assets or value-drivers:
- Customers Records (e.g. 200,000 accounts) x $400 Lifetime Value
- Credit Card Numbers (e.g. 100,000 account numbers) x $7 per data breach notification
- Revenue Generating Accounts (e.g. 200,000 accounts) x $20/monthly subscription
While not perfect, the above is a simple illustration of how to quantify your assets in order to effectively safeguard them and calibrate your InfoSec investments year over year.
7. Understand the threat Environment and essential countermeasures
Each industry is different - e-commerce, banking, manufacturing, etc. Each has a unique set of threats. For orientation, join the federal Information Sharing and Analysis Center (ISAC) related to your industry or specialty area. ISACs work with federal organizations (e.g. homeland, defense, intelligence) to publish threat intelligence to enable collective defenses unique to your industry. Benefit from the work of US intelligence and industry peers.
Get started by listing threat types (e.g. external hackers, insiders, hacktivists, etc) and then write scenarios describing the techniques used. You may want to classify adversaries based on the threat actor’s skill/sophistication level, motivation type, and/or resource levels. For example, a Ukrainian-based credit card hacking syndicate could be categorized as highly sophisticated, profit-driven, highly motivated and exceptionally well-resourced. In contrast, environmental hacktivists may be highly motivated, but lack technical sophistication and resources. Your threat picture drives your defenses. Although SOC 2 is largely an exercise in compliance, don’t overlook potential practical benefits of attaining your SOC 2 Report.
8. Select your security controls after building up your situational awareness
Security controls enable compliance through policy enforcement and help to mitigate risks ranging from internal insiders (e.g. disgruntled employees) to external hacking groups.
Control selection is largely a subjective exercise based on your knowledge and experience. That said, a myriad a security control frameworks exist related to compliance, service delivery, and cybersecurity. Organizational-related controls (e.g. ISO 27001) often include HR areas (e.g. employee background checks, on-boarding/exit checklists, performance reviews, etc.) and audit-related controls (e.g. monitoring, audits, record keeping, etc).
Technical controls often originate from governmental or industry groups. For example, the federal government publishes the most sophisticated security control framework as part of NIST (i.e. NIST 853) and a variety of related publications (e.g. system classification, risk management, etc). Entities such as banks may be regulated by OCC or FDIC and examined using FFIEC’s standard or the new FFIEC the Cybersecurity Assessment Tool (CAT).
Pro Tip: Consider mapping your controls to NIST since it remains the most comprehensive and up-to-date security control framework and most security controls map back to NIST, so you may be able quickly perform a gap analysis or meet new standards (e.g. HIPAA, PCI, etc).
As a practical matter, you should select security controls to address critical areas:
- System Description
- Cyber Risk Management
- Employee Handbook
- Information Security Policy
- Organizational Structure
- Security Control Matrix
- Access Control
- Security Awareness and Training
- Audit and Accountability
- Security Assessment and Authorization
- Configuration Management
- Contingency Planning
- Identification and Authentication
- Incident Response
- Physical and Environmental Protection
- Security Planning
- Personnel Security
- Risk Assessment
- Vendor Management
- System and Communications Protection
- System and Information Integrity
Pro Tip: Be careful not to overlook personnel security, physical security, and vendor management areas. Adversaries will target people, facilities, or critical vendors if they are comparatively weak and your technical security controls are exceptionally strong. Aim to maintain a well-balanced security portfolio in order to effectively deter, detect and respond to adversaries.
9. Develop your InfoSec Policy and nested policies using simple, declarative statements
a. Development of policies
Too often, organizations become too prescriptive and detailed in their InfoSec Policies. Instead, base your policy upon the security control. Collectively, the policies are summarized in the organization’s written information security policy. Consider declarative statements of what must happen, should happen, could happen, and/or won’t happen. Avoid adding too much detail, otherwise deviations from the policy may result in audit deficiencies.
b. Development of procedures
Next work on the policy’s related procedures. Often times, various elements within the organization will put “meat on the bone” by writing the procedures to achieve the policy objective. During this phase, engage stakeholders such as Engineering, Compliance, Legal, Vendor Management, etc. Procedures and standards (steps) should evolve naturally. Remain flexible - draft Policies and Procedures in a Google Doc to allow for collaborative comments.
c. Achieving consensus - Forming an Executive Risk Team or InfoSec Working Group
The process of control selection and policy/procedure development may surface differences of opinion, which is normal within an organization. Try to understand and appreciate the issue from the other person’s perspective and related pressures (e.g. budget, deadlines, staff cycles, etc.). Form an Executive Risk Team or InfoSec Working Group to work through any issues.
d. Execute your implementation actions to enforce your policies and procedures
To maintain compliance, you may require changes to your existing processes/job roles or adoption of new technical tools. Try to automate what you can since humans are prone to procrastination, taking vacations, shifting priorities, etc. Aim for foolproof processes to avoid falling out of compliance. If processes are too burdensome, then people will avoid them.
e. Develop a culture supportive of customer data protection and risk management
In the end, security is everyone’s problem since any given employee can introduce new vulnerabilities to the organization and place customer records at risk. Information security efforts will only be effective if all leadership understands the consequences of practices dangerous to security or circumvention of security controls in favor of convenience. So it’s important to achieve buy-in among leadership and embrace a “trainer the trainer” approach so every employee understands that performance includes safeguarding of corporate data.
10. Communicating progress towards SOC 2 (e.g. scope, budget, schedule, quality)
The SOC 2 Type II examination is similar to any other project. The project has a start, middle, and end. Be sure to communicate your progress and risks with mitigation options. Based on the size of your organization and culture, you may want to prepare the following management tools: Charter/Objectives, Stakeholder Matrix, Schedule or Timeline, Task List (Work Breakdown Structure), Communication Plan, Decision Rights Matrix (if needed), and Reporting Format (progress, blockers, risks, etc.). Communication is critical to the success of any project.
11. Conducting a Pre-Audit Rehearsal
You’ve already assessed your organization, described your system, selected controls, authored policies and procedures, implemented your changes, and now it’s time to prepare for the audit - both interim testing and then final testing to measure the operating effectiveness of your security controls. The examination requires formal (written) and evidentiary support (documented artifacts) demonstrating your procedures. Evidence may come in the form of system reports/records, screenshots, issue logs, meeting notes, config files, and/or interviews.
During the rehearsal, you’re likely to review the anticipated controls and gather evidence to be presented to the auditor - an exercise which helps streamline the engagement and make it more cost-effective. You want to avoid a lot of back-and-forth with the auditor, which could generate deficiencies/exceptions or prove very distracting. Throughout the readiness engagement, CAG communicates with the selected CPA firm to ensure the prepared documentation meets with the CPA’s internal standard, which often vary from firm to firm.
12. The Final SOC 2 Type II Report
The final SOC 2 Type II report will include your management’s attestation letter, system description, auditor’s review of security controls and operating effectiveness and exceptions (if any). In authoring your system description, you’ll want to describe your system’s resources and services in sufficient detail, so your potential customers and/or partners find comfort and appreciate the audit of these system components. You’ve worked hard - take credit for it.
The issuance of the formal report should be uneventful if proper preparation and readiness efforts were made. Nobody should be surprised at any point in the process.
SOC 2 can be a great opportunity to baseline or improve your InfoSec program. Capture your notes somewhere - they may help to move beyond compliance and inform your InfoSec Roadmap and edit/enhance your InfoSec Policies and Procedures during the following year.
Every journey starts with the first step - request a meeting below and we’ll be in touch. CAG will do everything possible to achieve SOC 2 compliance the quick and easy way. Contact our team to learn more.
ABOUT US
CAG works proactively to protect digital assets and prevent reputation damage from cyber adversaries.
Our task-organized teams are comprised exclusively of professionals with 10+ years in US cyber intelligence, advanced research & engineering, military operations and/or federal law enforcement. Our culture is mission driven and service oriented.
Our task-organized teams are comprised exclusively of professionals with 10+ years in US cyber intelligence, advanced research & engineering, military operations and/or federal law enforcement. Our culture is mission driven and service oriented.
