The Service Organization Control 2 (SOC 2) report has become, for many organizations and industries, the gold standard in security and integrity. While SOC 2 can be relatively comprehensive, more than the basic SOC 2 may be needed as regulatory and industry landscapes evolve. Enter SOC 2+, also known as a SOC 2 report with additional subject matter. 

By incorporating additional subject matter from other compliance frameworks or regulations, SOC 2+ offers a more comprehensive overview of an organization’s control environment. But what does SOC 2+ entail, and how can organizations prepare for this audit? This article will demystify SOC 2+ compliance and provide practical guidance on navigating this complex but critical process.

What Is Additional Subject Matter in SOC 2 Compliance?

SOC 2 is a report generated by an independent auditing body that verifies whether a service organization manages customer data based on five trust service criteria (also known as principles) established by the American Institute of Certified Public Accountants (AICPA): 

1. Security
2. Availability
3. processing Integrity
4. Confidentiality
5. Privacy

In addition to these five principles, an organization may opt to include additional subject matter in their SOC 2 report. These additional subjects might be industry-specific controls, regulatory requirements, or other aspects of the organization’s internal control environment. 

Some examples of these subjects include:

• Industry-Specific Controls: Additional controls may be required or recommended based on industry standards. For example, a healthcare organization might have controls related to HIPAA compliance while a payment service provider may have to meet requirements defined by PCI DSS.
  

• Regulatory Requirements: Required compliance rules may fit with, or alongside, SOC 2 guidelines. For example, organizations that operate in the European Union or handle the data of EU citizens may need to consider GDPR compliance alongside SOC 2.
  

• Advanced Cybersecurity Measures: While the security principle in SOC 2 covers the basics, an organization might opt to include advanced cybersecurity measures in their report. For example, they may have controls related to threat intelligence, advanced persistent threat (APT) detection, and zero trust architecture.
  
• Environmental and Social Governance (ESG): Some organizations may include controls and principles related to ESG issues, like environmental sustainability, diversity and inclusion, and ethical business practices. 
• Third-Party Vendor Management: If an organization relies heavily on third-party vendors, it may include controls related to vendor selection, monitoring, and management.

Any additional subject matter for a SOC 2 report should still meet the essential criteria for control: it should be designed effectively, appropriately implemented, and operate as intended over the review period. 

The additional subject matter would also need to be auditable, meaning sufficient evidence should be available to support the auditor’s conclusions.

What Types of Additional Subject Matter Exist?

The other subject matters included in a SOC 2+ audit can vary widely, depending on the industry and specific needs of the audited organization. Many of these are associated with specific industries or business services.

Some of these include: 

• HIPAA: HIPAA regulates the handling of Protected Health Information (PHI). Healthcare organizations, or organizations that handle PHI, may include HIPAA requirements as additional subject matter in a SOC 2+ audit.
  

• The General Data Protection Regulation (GDPR): GDPR is a European law governing data protection and privacy. Organizations inside and outside the EU might choose to include GDPR compliance in their SOC 2+ audit if handling the data of EU citizens.
  

• NIST SP 800-53: The National Institute of Standards and Technology’s Special Publication 800-53 contains guidelines for federal information systems, excluding those related to national security. Organizations that work with federal data might include these guidelines in their SOC 2+ report.
  

• ISO 27001: The International Organization for Standardization standard outlines best practices for an information security management system (ISMS). Some organizations might align their SOC 2+ report with ISO 27001.
  

• CCPA: The California Consumer Privacy Act (CCPA) is an example of regional data protection laws that might be included in a SOC 2+ audit. This framework resembles GDPR but applies specific to California residents and businesses. 
  

• FedRAMP: The Federal Risk and Authorization Management Program outlines cloud products and services security standards. Companies providing these might include FedRAMP controls in their SOC 2+ audit.
  
• PCI DSS: The Payment Card Industry Data Security Standard serves as an industry requirement for processing credit card payments, designed and managed by major credit card companies. Companies that handle credit card data might include PCI DSS controls in their SOC 2+ audit.

These are just a few examples. The specific additional subject matters included in a SOC 2+ audit will depend on the organization’s unique needs and circumstances. Remember that these other requirements should be treated as supplements to the core Trust Service Principles in SOC 2, not replacements.

Why Would My Organization Pursue Additional Subject Matter In SOC 2?

It’s clear, then, that including additional subject matter into a SOC 2+ report can help any business maximize their security efforts and centralize auditing and self-assessment. 

Some of the primary benefits that come with pursuing SOC 2+ include:

• Mandatory Regulatory Compliance: Some industries are subject to specific regulations that dictate how they must handle data. Including these regulations in a SOC 2+ audit can assure stakeholders that the organization complies. It also helps to avoid potential fines and penalties associated with non-compliance.
  

• Risk Reduction: These criteria cover a more comprehensive array of potential threats and vulnerabilities, which can help an organization reduce its risk exposure. This might include data breaches, service disruptions, or regulatory non-compliance risks.
  

• Competitive Advantage: A SOC 2+ report can differentiate an organization from its competitors. It shows potential clients, partners, and investors that the organization takes data security and privacy seriously and is willing to go above and beyond basic requirements. Clients who know that an organization has passed a SOC 2+ audit can have greater confidence in its ability to safely and effectively handle their data. This can build trust and loyalty, making clients more likely to choose and stick with the organization.
  

• Comprehensive Security: Preparing for a SOC 2+ audit can help an organization identify gaps in its processes and controls. Addressing these gaps can improve operational efficiency and effectiveness.
  

• Scalability: Compliance with multiple standards from the start prepares organizations for future growth. As they expand into new markets or sectors, they’ll already comply with the relevant data handling and security standards, reducing friction during scaling.
  
• Streamlined Auditing: SOC 2+ audits consolidate multiple auditing processes into a single effort, saving time and resources while reducing the potential for conflicting audit outcomes.

These factors contribute to an organization’s overall resilience and reliability, making it better equipped to handle challenges and seize opportunities. However, it’s worth noting that undergoing a SOC 2+ audit is a significant endeavor that requires substantial resources and a commitment to ongoing compliance and improvement.

How Can We Prepare for a SOC 2 Audit with Additional Subject Matter?

Preparation for a SOC 2+ audit (i.e., a SOC 2 audit with the additional subject matter) requires careful planning, just like a standard SOC 2 audit, but with more comprehensive coverage. Here are some steps to prepare:

• Understand the Requirements: Identify which trust service principles apply to an organization and understand the additional criteria from other frameworks or regulations. Research these criteria thoroughly to understand what they entail fully.
  

• Gap Analysis: Conduct an internal review to identify gaps between current practices, the SOC 2 trust service principles requirements, and the additional subject matter planned for the audit. Identify any weaknesses or gaps that need to be addressed.
  

• Remediation: Develop a plan to address the gaps identified in the analysis. This might involve developing new processes or controls, implementing new technologies, or training staff. This step is critical in ensuring an organization can meet the audit requirements.
  

• Documentation: Document all policies, procedures, and controls related to the SOC 2 requirements and the additional subject matter. This is a critical part of the audit process, as the auditors will need to review these documents to verify that the controls are designed effectively.
  

• Internal Audit: Conduct an internal audit to test the effectiveness of implemented controls. This will allow organizations to fix any problems before the external audit.
  

• Engage a Service Auditor: Engage an independent CPA or auditing firm to conduct the SOC 2+ audit. Ensure they have experience with SOC 2 audits and the other subject matter included.
  
• Continuous Monitoring: Keep monitoring and improving controls after the audit. Compliance is not a one-time event but an ongoing process.

Get Ready for SOC 2+ with Lazarus Alliance

Preparation for a SOC 2+ audit is a significant undertaking that requires a deep understanding of the requirements and a commitment to continuous improvement. Working with a consultant or an experienced auditing firm might be helpful to ensure an organization is adequately prepared.