All cyber leaders know regulatory compliance is not simply optional, whether it’s following the new rules handed down by the SEC or staying in the ever-shifting state data privacy lines. While following government rules is all well and good, your potential partners only know about it when you haven’t done so, which is why voluntary industry frameworks like NIST, ISO and SOC 2 can differentiate you from competitors. Drata’s Alev Viggio looks closer at the SOC 2 compliance standard.
Editor’s note: Alev Viggio, author of this article, is compliance director at Drata, a security and compliance automation provider.
More than two-thirds of organizations say that a focus on compliance plays an important role in opening new business opportunities, and as cloud infrastructure becomes increasingly ubiquitous, SOC 2 has emerged as one of the most important compliance standards.
While SOC 2 isn’t a government regulation — and so failure to comply won’t result in fines or sanctions — the framework is designed to gauge whether an organization has controls in place to meet industry standards for data security and privacy, as well as assessing how effective those controls are. Today’s businesses are collecting vast amounts of data, and potential partners and customers want to know that that data is being kept safe. Demonstrating compliance with SOC 2 controls is an easily understandable way to show that the organization is adhering to best practices when it comes to data security.
Businesses that cannot clearly illustrate their level of SOC 2 compliance may have a difficult time finding partners and customers willing to trust them with their data. Whether or not an audit is looming, organizations should always have SOC 2 and its requirements in the back of their mind and be prepared to discuss their compliance program with potential new business partners.
Be prepared for both types of SOC 2 attestations
There are two types of SOC 2 attestations: Type 1 and Type 2. A Type 1 attestation provides a point-in-time snapshot of the effectiveness of an organization’s security controls, while a Type 2 report gauges the effectiveness of those same security controls over a period of six months to a year.
A Type 1 report can provide valuable information, but a Type 2 report provides more data on the effectiveness of cybersecurity controls over time, which is why potential partners and customers will generally want to see a Type 2 report at some point. That said, when an organization is planning for its first SOC 2 audit, it is common to aim for SOC 2 Type 1 and then plan for Type 2.
Ultimately, businesses want to know that they are entering into a relationship with an organization that has a demonstrated track record of good data stewardship. Organizations need to gather data on the effectiveness of their controls over time according to five trust services criteria: security, availability, confidentiality, processing integrity and privacy. These criteria help give potential partners and customers a clear look into the efficacy of an organization’s security program.
Planning for a SOC 2 Type 2 audit should start at least a year in advance — and probably even earlier than that. While the timeline for becoming SOC 2 compliant varies by organization due to several factors (including the organization’s state of readiness, complexity of business operations and how well their current setup aligns with the five criteria), rushing the process rarely produces good results.
How Organizations Can Leverage Human Nature to Instill Security Culture
Training is important, but it’s not enough
Read moreDetailsSOC 2 isn’t pass/fail
Another common misunderstanding when it comes to SOC 2 is that there is no such thing as a “SOC 2 certification.” SOC 2 isn’t assessed through a pass/fail lens — the result of a SOC 2 audit is a report that indicates the auditor’s opinion of how the organization’s security controls measure up to each of the criteria in the SOC 2 framework. That report will indicate which criteria were met, which areas need improvement and which were not met — and there is even space for the auditor to include qualifications for extenuating circumstances.
The information contained in the report is much more detailed than a simple certificate of compliance, meaning that potential partners and customers can get a much more complete idea of where an organization’s data security capabilities stand.
That also means that the audit isn’t a one-time thing. It needs to be performed on an annual basis, which means organizations can’t just breathe a sigh of relief and move on to other things once they have a report in hand. It is best practice for most organizations to maintain an annual SOC 2 reporting cycle. No doubt, this is a big commitment, but an annual cycle provides stakeholders with assurance on the effectiveness of your controls and the security of your environment. Once the right security controls and reporting tools are in place, that should streamline the process of generating the information the auditor will need each year.
SOC 2 is about demonstrating results
SOC 2 does not mandate specific controls organizations must implement. Instead, it provides a framework and set of criteria for organizations to assess and report on the effectiveness of their controls related to security, availability, confidentiality, processing integrity and privacy. Organizations have the flexibility to select and implement controls that are appropriate and relevant to their operations, industry and regulatory requirements.
That means organizations can meet SOC 2 criteria in vastly different ways, providing them with the flexibility they need to choose the solutions that work best for them. And that flexibility is invaluable — after all, different controls might work better for different companies, depending on factors like industry, business size and location.
So long as the organization can demonstrate to the auditor’s satisfaction that it is meeting the prescribed benchmarks, they’re in good shape. That isn’t as straightforward as following a prescribed set of instructions to check the necessary boxes for an audit, but it gives organizations the latitude to focus on results instead.
Alev Viggio is the director of compliance at Drata, a security and compliance automation provider. Prior to Drata, Alev served key compliance roles at Sigma Computing and Conga and was an internal auditor at Solihull Systems. Alev oversees Drata's compliance program and ensures adherence to frameworks, standards and regulations like SOC 2, HIPAA and GDPR. 
