A guide to SOC 2 compliance for SaaS developers and other cloud services providers

As cyber threats present greater risks to enterprises of all sizes and in all industries, more are requiring that their SaaS providers and other cloud services vendors have an SOC 2 certification. Let’s examine what an SOC 2 certification is and why your cloud services business should get one.

What Your Cloud Business Needs to Know About SOC 2 Certification

What is an SOC 2 report?

The SOC 2 is part of the American Institute of Certified Public Accountants (AICPA) Service Organization Control (SOC) reporting framework, utilizes the AT-101 professional standard, and is based on the five AICPA Trust Services Principles. Companies undergo SOC 2 audits to assure their clients that their organizations have implemented specific controls to effectively mitigate operational and compliance risks.

SOC 1 vs SOC 2 vs SOC 3

An SOC 1 report utilizes the SSAE 18 standard and reports on internal controls over financial reporting (ICFR), while an SOC 2 attestation is performed in accordance with AT-101 and addresses non-financial controls. The SOC 2 was developed to meet the needs of technology service providers, so that they could attest to their adherence to comprehensive data security control procedures and practices. Distribution of SOC 1 and 2 reports is restricted to certain stakeholders, such as compliance officers, auditors, or business partners.

The SOC 3 is a simplified version of an SOC 2. It reports on the same information, but the report is shorter, contains fewer details, and is meant for a general audience. Distribution of SOC 3 reports is unrestricted; they can be shared with anyone, including via posting on the company’s website.

What are the AICPA Trust Services Principles?

Companies undergoing an SOC 2 audit must attest to their compliance with one or more of the AICPA Trust Services Principles:

Security: Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
Availability: Information and systems are available for operation and use to meet the entity’s objectives.
Processing integrity: System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
Confidentiality: Information designated as confidential is protected to meet the entity’s objectives.
Privacy: Personal information is collected, used, retained, disclosed, and disposed to meet the entity’s objectives.

Reporting organizations are not required to address all five Trust Service Principles; SOC 2 attestations can be limited to the principles that are relevant to the services being provided.

SOC Type 1 vs Type 2

An SOC 2 Type 1 audit provides a snapshot of an organization’s controls at a point in time, while an SOC 2 Type 2 audit examines them over a specified period. Because the Type 2 is far more rigorous, this is the certification most companies will want their SaaS and cloud providers to have.

The benefits of an SOC 2 Type 2 attestation

Unlike regulatory standards such as PCI DSS and HIPAA, SOC 2 attestations are not required by law. However, they are well worth the investment. Companies that undergo SOC 2 Type 2 audits are demonstrating to their customers that they have comprehensive internal security controls in place and that these controls have been tested over time and proven to work. This is a major competitive differentiator in our increasingly dangerous cyber threat environment. Companies that have a choice between two cloud services vendors, one with an SOC 2 Type 2 and the other without, will choose the one with the certification.

How much does an SOC 2 audit cost?

The cost of an SOC 2 audit depends on your organization’s size, data environment, and current security controls, as well as the method your auditor uses to perform your SOC 2 audit. Lazarus Alliance utilizes Continuum GRC’s IT Audit Machine (ITAM), the number-one-ranked IRM GRC audit software solution for AICPA SOC audits, which allows us to get our clients from start to compliant quickly and effectively while dramatically reducing their costs.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

New HHS publication outlines top cyber threats & best practices for healthcare industry

Noting that cyber security is “the responsibility of every health care professional, from data entry specialists to physicians to board members,” the U.S. Department of Health and Human Services (HHS) has published Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP). The four-volume publication, which was mandated by the Cybersecurity Act of 2015, is aimed at hospital executives and cyber security professionals in healthcare organizations of all sizes and leverages the NIST Cybersecurity Framework.

HHS Publishes Healthcare Cyber Security Guidelines Based on NIST CSF

HHS: Email phishing & ransomware among top cyber threats to healthcare organizations

The HHS guide focuses on what the agency considers to be the current top cyber security threats to the healthcare industry: email phishing; ransomware; loss or theft of hardware; insider, accidental, or intentional data loss; and attacks against smart medical devices that put patient safety at risk. The publication’s two Technical Volumes outline 10 best practice areas to mitigate cyber security threats:

Email protection systems

Endpoint protection systems

Access management

Data protection and loss prevention

Asset management

Network management

Vulnerability management

Incident response

Medical device security

Cybersecurity policies

Rather than introducing a new framework, HHS instead maps its best practice and sub practice recommendations to those in the NIST CSF. Recognizing the fundamental differences and concerns that organizations of different sizes encounter, separate recommendations are given for small, medium, and large organizations.

The financial impact of healthcare breaches can be devastating, especially to small organizations. The HHS points out that the healthcare industry has the highest data breach cost of any industry, at an average of $408 per record and $2.2 million per organization. In 2016, the healthcare industry as a whole lost $6.2 billion to data breaches.

HHS urges proactive healthcare cyber security, comparing cyber hygiene to hand-washing

Healthcare cyber security has been a vexing issue for quite some time, and many issues stem from a lack of employee cyber security training. Unlike many industries, which made the switch from paper and typewriters to digital files and computers over a period of years, the healthcare industry digitized practically overnight. Employee training on cyber security best practices is notoriously spotty; healthcare organizations tend to focus on HIPAA compliance, with cyber security awareness an afterthought at best. The HHS notes that healthcare facilities often “deploy technologies without cybersecurity safeguards or use them (intentionally or unintentionally) without proper protections” and points out that four out of five U.S. physicians have experienced some form of cyber attack.

Employee buy-in presents another problem. Many front-line healthcare workers feel that their only job is to care for patients and that cyber security is the IT department’s problem. The HHS publication points out that in modern healthcare, cyber security is a function of patient care. Cyber attacks on electronic health records systems and smart medical devices don’t just disrupt business operations; they put patients’ health and even lives at risk. As such, the HHS states, healthcare workers must be taught to see cyber security hygiene the way they are taught to see hand hygiene; just as they wash their hands to prevent the spread of infections, they need to practice cyber hygiene to protect electronic patient records, IoT devices, and other healthcare systems from malware infections and other cyber attacks.