What is an SOC Report?

In a world where data is becoming increasingly valuable to companies and cybercriminals alike, ensuring that providers operate ethically and legally when handling that data is more important than ever. Credibility and trustworthiness are integral to operations, assuring any data collected and stored from customers and partners is secure, confidential, and available upon request. 

System and organization controls (SOC) reports enable organizations to do this using third-party accreditation from the American Institute of Certified Public Accountants (AICPA), providing an impartial examination of how an organization deals with the following aspects: 

• Network Security 
• Data Availability 
• Data Processing Integrity 
• Data Confidentiality 
• Data Privacy 
• Financial Reporting Control 
• Cybersecurity Controls 

SOC audits are a way to assess a range of best practices according to an unbiased and transparent framework laid out by the AICPA, helping potential customers and partners assess potential risks when dealing with the respective organization. By doing this, organizations can prove their operations are legal and ethical using the data within the SOC report. 

SOC Report Types 

There are three SOC report types that deal with different aspects of an organization’s operations and the types of organizations involved. Here, we explore each in more depth. 

SOC 1 

Based on the SSAE 16 reporting standard, SOC 1 reporting assesses the internal controls for financial reporting, including transaction processing and support for IT controls. This SOC report is relevant not only to the immediate effects on an entity's financials but also looks at the effects downstream. 

SOC 2 

SOC2 reporting broadens the scope of the data by assessing security, availability, processing integrity, confidentiality, and privacy. The AT 101 reporting standard states that security control testing is mandatory, whereas the other elements are optional. The Trust Services Criteria underpin these SOC reports. 

SOC 3 

Previously known as SysTrust or WebTrust, SOC 3 reporting is essentially a stripped-down version of SOC2. However, by excluding specific details of controls and results during testing, these SOC reports can be made available to the general public and are often used for marketing purposes. 

What's the Difference Between Type I and II SOC Reports? 

Each of the above SOC auditing frameworks is available in two types, both of which aim to provide different reports. The main difference between the two types of reports is where and when data is examined. 

• Type I Reports – Examines controls at a single point in time 
• Type II Reports – Examines controls over a period of time 

This means that type I and type II reports offer differing focus descriptions for each SOC audit. These are as follows: 

What to Expect from an SOC Audit 

Deciding on the type of SOC report most suitable to your organization and its goals is the first step in getting audited. Once you have done this, the official process will begin with implementing an SOC Readiness Assessment to help your organization prepare for the full SOC audit. The SOC identifies deficiencies, gaps, and other potential red flags and works with managers and security teams to repair them. 

Next, you will need to speak with your auditor about the scope of the SOC audit and gather all relevant information on elements such as tech stacks, data flows, infrastructure, business processes, and people. Depending on which SOC report you choose, you will also need to determine which Trust Service Categories to include. 

Your auditor will then conduct fieldwork within your organization. Fieldwork includes reviewing all the evidence and may require walkthrough meetings and clarification on specific controls. Additionally, randomly selected samples of controls such as new hire onboarding, access removal for terminated employees, background checks, and security awareness training may be required. 

SOC Audit Process and Checklist 

This SOC audit checklist can form the foundation of your preparations to enable your organization to plan for an audit. While each SOC report may require slightly different elements, the core requirements remain very similar. 

• Choose which SOC report is best for your organization based on your operations 
• Choose which type of SOC report is most valuable to your organization 
• Define the scope of the audit both internally and with your auditor 
• Perform an internal risk assessment across your entire organization 
• Implement a gap analysis and remediation 
• Implement appropriate controls 
• Understand regulatory compliance and legal ramifications 
• Perform a Readiness Assessment 

How to Pick an SOC Report Type 

Choosing the correct SOC report for your organization's needs is critical, as the auditing process can be both time-consuming and costly. Generally speaking, you can follow the guidelines here: 

• SOC 1 – Intended to meet auditing requirements on financial controls for regulatory compliance   
• SOC 2 – Commonly used by software providers and vendors who are responsible for sensitive information. Looks at Trust Service Criteria defined by the AICPA. 
• SOC 3 – An addition to the SOC report that allows you to share your compliance with Trust Service Criteria with the public. 

Your decisions should also factor in the size, function, and age of your organization, with SOC 1 being an entry-level for those who don't deal in large swathes of customer data and SOC 2 being a comprehensive investigation into the trustworthiness of a company. 

Next, deciding on Type I and Type II reports is much the same, as the jump from a Type I report to a Type II report is significant in both cost and time. If your organization is new, say a burgeoning start-up, then achieving Type II accreditation may be a challenge, as your organization's controls may not have been in operation long enough to pass the rigorous testing over time. In this case, the ideal approach might be starting with Type I accreditation and working towards Type II accreditation in the future 

Type II reports are preferable for more established organizations as they offer greater assurances to all stakeholders. In addition, pairing a Type II report with SOC 3 report can enable you to prove to the public and potential partners that your company is fully compliant and constantly striving to meet best practices regarding data management. 

The Bottom Line 

A good SOC report should give stakeholders the information they need to make informed decisions about an organization's security posture. With so many types of SOC reports out there, it can be tough to decide which one is right for your organization. But armed with this knowledge, you should be able to make a decision that best fits your needs.