SOC 2 Made Simple
Category
Awareness, Cybersecurity Fundamentals
Risk Level
Are you tired of filling out lengthy vendor questionnaires and are looking to pursue an SOC 2 examination report instead? Discover some basic practices to secure your customers’ data and pave the way for SOC 2 certification.
Has a customer or potential customer ever asked you for a copy of your SOC 2 examination report? If you didn’t have one, did you have to fill out a lengthy questionnaire about your product or company's cybersecurity poster? If you’ve never been through SOC 2 examination before, knowing where to start can be a little daunting - but there are a few things you can (and should) do up front to protect your organization, your product, and help pave the way for SOC 2 compliance should you ever choose to be assessed.
“What exactly is SOC 2?”
First and foremost: SOC, or System and Organization Controls, is a framework created by the American Institute of Certified Public Accountants (AICPA) to build trust with customers and partners. SOC 2 focuses on the cybersecurity controls in place within your organization or product to protect your customers’ data and other sensitive information on your network.
There are two types of SOC 2 assessments and reports, Type 1 and Type 2. A SOC 2 Type 1 report focuses on how your organization has designed your controls, and is only for a specific point in time. SOC 2 Type 2 is more frequently requested because it assesses the control effectiveness over a period of time - so not only ensuring you have the controls, but that they’re working. This is what your customers and partners likely care about when deciding whether to use your product.
“Do I need a SOC 2 audit?”
Technically, no. However, cybersecurity controls that satisfy SOC 2 are a good baseline for any organization to implement. If you want to show you have a secure product and are implementing the controls anyway (along with having the funds to pay for the audit) then having a report you can hand over to a customer saves you time and effort over those vendor questionnaires.
“So what should I do?”
There are seven different practices you can implement up front that will help pave the way to SOC 2 success. Even if you don’t want to pursue SOC 2, you should implement these cybersecurity controls to make sure your environment and products are secure:
Access Control
Change Management
Centralized Logging
Configuration Management
Least Privilege
Mobile Device Management
Vendor Risk Assessments
Access Control
Single Sign-On is one of the most effective ways to implement access control for your users. Link and enforce as many third party applications as possible to SSO, disable any non-SSO logins, and turn on multi-factor authentication, and you’ve covered dozens of line items for your SOC 2 audit. Implementing SSO lets you disable a user’s access to all linked applications from one location, and multi-factor authentication significantly reduces risk of a hacker accessing one of your employee’s accounts to get on your network.
Change Management
If you’re using a code repository like Github, enable “Protected Branches.” For any changes that are going to be deployed to production, require a secondary reviewer and approval before the changes are pushed, and push deployments through a CI pipeline that runs a few tests on the code. Make sure the process is repeatable and followed by all of your developers, and you’ve covered another large portion of the SOC 2 audit.
Centralized Logging
You’ve locked down your access and made sure any changes pushed to your environment are tested and approved - now you need to monitor those controls. There are many centralized logging services available including paid options (e.g. AWS Security Hub) and open source options (e.g. Wazzuh, so the one that’s the right fit for your company and make sure all your logs are sent to it. Set up some alerts for unusual activity and make sure those alerts are going to a team that can investigate.
Configuration Management
This goes hand in hand with your change management process. Make sure your configurations are documented, and any changes to those configurations are tracked and repeatable. If you’re using Github, store all your configurations there so that you can reference and enforce them.
Least Privilege
Make sure your users have the lowest level of privileges needed to do their job. For example, your Human Resources personnel don’t need to be global admins. If you are using AWS, your accounts should be provisioned using IAM and should escalate privileges as needed with AssumeRole. If you’re using Azure, your accounts should be provisioned using Entra ID and should escalate privileges with Privileged Identity Manager. These are just a few examples of ways to ensure least privilege is being followed in your organization, but the escalation of privileges should also be logged and monitored. Forward those logs to the centralized logging service you chose earlier, and monitor for when those users push changes to the environment.
Mobile Device Management
Make sure your employees are enrolling the devices they use for work in a Mobile Device Management (MDM) rool, like JumpCloud, InTune, or Jamf Pro. Then you can make sure the endpoints accessing your data are encrypted and have the latest patches. Having an MDM solution will answer a lot of endpoint security questions for SOC 2 because you have control over what’s enforced on the endpoints.
Vendor Risk Assessments
Before you sign up for any more applications or software, ask for their cybersecurity documentation (e.g. now YOU get to flip the script and ask for THEIR SOC 2 Type 2 report!) and save it to a Google Drive, SharePoint, a Confluence page, or some other repository for vendor cybersecurity documentation. If they don’t have it, identify what cybersecurity controls you care about based on the information that software will access, and have them fill out a questionnaire. Keep a list of the vendors you’re using that access sensitive data, and how you made a decision about using them.
Not sure how to get started with these cybersecurity practices, or how to identify what is the right fit for your organization? Hive Systems can help! Our subject matter experts are well-versed in cybersecurity solutions to fit organizations of all sizes from startups to enterprises, and have a deep understanding of what it means to be SOC 2 compliant. We have even built that knowledge into our SaaS tool, Audora, to help streamline the audit experience. Reach out to us today to learn more about our Cybersecurity Policy & Controls or Information Assessment & Compliance Services!
Ready to automate your SOC 2 audit?
With Audora, you can automate audit engagements and get a full audit report in the click of a button. Enhance competitiveness and optimize your team's capacity with one tool. Start your audit transformation today!
Follow us - stay ahead.
