The Service Organization Control 2 (SOC 2) report has become, for many organizations and industries, the gold standard in security and integrity. While SOC 2 can be relatively comprehensive, more than the basic SOC 2 may be needed as regulatory and industry landscapes evolve. Enter SOC 2+, also known as a SOC 2 report with additional subject matter. 

By incorporating additional subject matter from other compliance frameworks or regulations, SOC 2+ offers a more comprehensive overview of an organization’s control environment. But what does SOC 2+ entail, and how can organizations prepare for this audit? This article will demystify SOC 2+ compliance and provide practical guidance on navigating this complex but critical process.

Read More

SOC audits are some of the most common non-regulatory audits in the U.S. These attestations provide companies with a way to demonstrate their dedication to transparent and secure financial reporting and protecting consumer information. Accordingly, SOC reporting can become an in-depth and complicated task that is rendered even more complicated when factoring in subservice providers. 

We’ll cover two ways to account for subservice provider services in your financial and IT infrastructure: carve-out and inclusive reporting. 

Read More

Audits and compliance are just part of doing business for financial organizations. Clients and partners must know that they can trust you to manage their critical information, keep it secure, and maintain its confidentiality. Frameworks like Systems and Organization Controls, or SOC, help organizations meet these expectations in a standardized way. 

While SOC 2 is generally the more popular all-purpose attestation for businesses, SOC 1 attestation is just as necessary, if not more, for financial service providers. 

Read More