Some security regulations and recommendations, like FedRAMP, FIPS, or HIPAA, are required of any managed service providers working in specific industries like government or healthcare. Others, like Service Organization Control (SOC) compliance, are not always necessary but help demonstrate that security controls are in place to protect client data. Because of this fact, they are an essential part of an MSPs auditing structure.

Learn more about why your MSP should be using SOC auditing and compliance as part of its business model.

What is SOC 1 Compliance?

If your MSP business or your clients handle financial information for customers or other organizations, then you should have regular Service Organization Control 1 (SOC 1) audits for certification.

The point of having a SOC report is to demonstrate that your organization handles financial information transparently through effective security, reporting, and accessibility. This is especially critical for industries like:

1. Payroll Processing. Many businesses employ large internal or third-party payroll processing companies to help them manage their payroll more efficiently. Likewise, these companies may utilize third-party cloud providers to handle their databases and processing capacity. 
2. Retail Data Centers. Large retailers handle thousands, if not millions, of payments from customers online and off. They also store tremendous amounts of data regarding payment information, shopping behaviors, and so on. Accordingly, any company handling customer data (whether it is the retailer themselves or an MSP handling mission-critical data) should consider SOC 1 audits. 
3. Collections or Credit Businesses. This may seem obvious, but any company handling any information for a collections or credit organization is by default handling private financial information for hundreds, if not thousands, of cardholders.

Note that SOC 1 reports aren’t a demonstration of the security per se, but of the bookkeeping in place (and the proper security and privacy controls in place for reporting purposes). For example, a SOC 1 report might show how a company handles revoking employee access to sensitive data after termination, or show a list of terminated employees and the actual implementation of that process. 

Any managed service providers or SaaS service supporting clients in these industries should also have regular SOC 1 audits. 

What is SOC 2 Compliance?

A SOC 2 report is similar to a SOC 1, in that it demonstrates that your security controls and procedures are strong enough to handle confidential user data along with more robust criteria. A SOC 2 report for managed service providers focuses specifically on demonstrating the security controls in place protecting user data. 

SOC 2 audits are rooted in what is called the Trust Service Criteria defined by the AICPA as:

• Security. The protection of systems and data against unauthorized access or anything that compromises confidentiality, integrity, or privacy. 
• Availability. Information is available for use to meet an entity’s objectives. That is, for example, is all the data readily available to your clients if you are storing that data in a cloud data center? 
• Processing Integrity. System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives. Demonstrates that your processing services serve the needs of your clients and, if not, those issues are corrected as soon as possible. 
• Confidentiality. Data designated as confidential is protected. Includes personal and non-personal information like transactions, business plans, legal documents, etc., and may vary from client to client. 
• Privacy. All personal information is collected, used, retained, disclosed, and disposed of properly. This differs from confidentiality in that it protects personal information like Social Security Numbers, phone numbers and addresses, financial information, or purchase history.

When performing a SOC 2 audit, the only required criteria in this list is Security, although many companies will opt for more thorough testing depending on their industry and the industries of their clients.

Should Managed Service Providers Generate SOC 3 Reports?

A SOC 3 report actually touches on all of the same data as a SOC 2 report does. However, where a SOC 2 report typically provides information to relevant stakeholders (internal investors, clients, client IT departments), a SOC 3 is intended for general audiences.

What does that mean for MSPs?

• The SOC 3 will contain much of the same information, but in less detail than the SOC 2 report. It may touch on the security of the company without detailing the security controls in place, for example. 
• A SOC 3 report will usually be posted publicly, like on your website. 
• A SOC 3 will also include other sections such as an auditor’s opinion and narrative that provides background on the report and the organization.
  
  
• SOC 3 allows you to place a certification seal or some other credential on your site so that potential clients can demonstrate to their internal auditors or IT that your system is secure. 

Should My MSP Conduct SOC 1 or SOC 2 Compliance Audits?

Generally speaking, Every managed service provider should have regular SOC 2 compliance audits. Since MSPs are invariably handling some form of client data, it benefits them to have this compliance and certification in place to maintain the trust of their clients and the safety of their data. 

Depending on the types of clients your MSP works with, however, there can be multiple levels of reporting to consider:

• While not required, a SOC 1 certification can benefit your partnerships by showing clients that you have the proper tools, particularly your reporting and data-handling tools, to support their businesses. Additionally, information from a SOC 1 report can also serve as part of any expected SOC 2 audits. 
• MSPs aren’t required to perform SOC 2 audits either unless specifically spelled out in an industry-standard or a contract with a client. But even if not, SOC 2 audits for security provide transparency for clients that your operations maintain critical security controls for their data. It also provides a certain reputation for customer support and service above and beyond strict industry compliance. 
• Clients or MSPs have some flexibility in terms of what criteria in the SOC 2 framework are important for their reporting needs. While the security standard is part of the audit, additional confidentiality or privacy requirements could uniquely fit a client in the financial industry. 
• A SOC 3 report won’t necessarily add anything new that a SOC 2 report won’t, but it can help with public perception and marketing. This demonstrates to the public your MSP’s commitment to security and any additional criteria relevant to your target industry. 

MSPs can benefit immensely from working with an auditing partner familiar with their target industries and with SOC 1 and SOC 2 audits more broadly. 

Do Managed Service Providers Need SOC Auditing and Certification?

The truth is that SOC certification is not required of an MSP as part of any general compliance regulations. 

However, if you are an MSP that serves clients, you may be asked to undergo, at minimum, SOC 2 auditing for general security controls. Many companies will expect that their MSP have their reporting in place to demonstrate the soundness of their security practices. It may be part of your contract with a client to have SOC 2 reporting with specific criteria in place.

Likewise, clients in the financial industries may further expect you to have SOC 1 reports as part of their own internal auditing and compliance requirements. 

What are the Benefits of Automated Reporting for Managed Service Providers?

SOC 2 auditing isn’t necessarily an easy practice, however. While the requirements for SOC compliance are clear, the annual data and reporting necessary to demonstrate compliance can take quite a long time, as in weeks to a month, to gather and certify. 

Many MSPs are turning to partners in cybersecurity to automate compliance reporting through traditional or continuous assessment models. These partners will either build in automatic data gathering for reporting or utilize continuous assessments to determine compliance and alert relevant parties when any system is out of compliance. 

Automated tools can help with either traditional or continuous assessments by making compliance reporting less costly, time-consuming, and painful for the reporting agency. With developments in AI and machine learning, these automated tools can help MSPs take steps to stay in SOC compliance year-round. Instead of weeks and months of reporting, you can adhere to client or industry demands in hours or days. 

Managed Service Providers want to show their clients that they can be trusted with their data. If you’re ready to undergo SOC 2 auditing or learn more about SOC reporting and compliance, contact us at 1-888-896-7580 or through the form below. And tap into your Cybervisor Services to work with some of the top security experts in the industry.