SOC 2: Build Trust and Confidence
2 likes1,953 views
The document provides an overview of SOC 2 reports, emphasizing their importance for building trust and compliance with regulatory requirements. It outlines the AICPA framework, key principles, report types, and considerations for service organizations and user entities. Additionally, it includes mapping of SOC 2 to other standards and the necessity of third-party assessments in vendor management programs.
SOC 2: Build Trust and Confidence
- 1. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved SOC 2: Build Trust & Confidence Overview & Considerations
- 2. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved 01. Background / Overview of SOC 2 02. The AICPA Framework 03. Purpose and Scope 04. The Anatomy 05. Considerations 06. Mapping – Other Standards 06. Q/A Contents
- 3. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Background & Overview 01 ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 4. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Growth & Popularity ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 5. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Service Auditors ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 6. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Service Providers
- 7. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved User Entities
- 8. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Why Do You Need a SOC Report? Regulatory requirements
- 9. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Why Do You Need a SOC Report? Regulatory requirements User entity mandates
- 10. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Why Do You Need a SOC Report? Regulatory requirements User entity mandates Vendor management programs
- 11. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Why Do You Need a SOC Report? Regulatory requirements User entity mandates Vendor management programs Due diligence
- 12. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Why Do You Need a SOC Report? Regulatory requirements User entity mandates Vendor management programs Due diligence Independent 3rd party opinion
- 13. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Why Do You Need a SOC Report? Regulatory requirements User entity mandates Vendor management programs Due diligence Independent 3rd party opinion Competition and market
- 14. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Overview • What is a SOC 2 report? • How does a SOC 2 differ from a SOC 1 report • SOC 2 versus SOC 3
- 15. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Overview of the AICPA Framework 02 ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 16. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved AICPA SOC Framework Applicable SOC-1 SOC-2 SOC-3 Standard/Guidance SSAE 16: AICPA Guide (2013) AT 101: AICPA Guide (2013) AT 101: Technical Practice Aid (2014) Scope ICFR Security/Systems, Privacy Security/Systems, Privacy Criteria Control Objectives Trust Services Principles/GAPP Trust Services Principles/GAPP Usage of report User auditor, user entity, management of SO Knowledgeable parties Anyone
- 17. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Purpose & Scope 03 ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 18. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Purpose • What SOC 2 does cover? • What SOC 2 does cover?
- 19. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • System • Boundaries • Commitments • System Requirements Scope
- 20. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Principles • Security • Availability • Processing Integrity • Confidentiality • Privacy
- 21. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Common Criteria (Security): 1: Organization & Mgmt 2: Communications 3: Risk Mgmt & Controls 4: Monitoring of Controls 5: Logical and Physical Access 6: System Operations 7: Change Management Principles
- 22. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Principles Availability Common Criteria: +3 Processing Integrity Common Criteria: +6 Confidentiality Common Criteria: +6 Privacy Common Criteria: +74
- 23. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • Type 1 • Type 2 Report Type
- 24. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved The Anatomy 04 ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 25. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Service Auditor’s Report – “The Opinion” Management’s Assertion Description of the System Tests of Controls and Corresponding Results Additional Information – Provided by Service Organization Report Structure
- 26. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Unqualified vs. Qualified Service Auditor’s Report
- 27. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • Commitment - suitability and accuracy • Subservice organizations Management’s Assertion
- 28. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • Management’s objective description of the services provided to user entities • Components of a System Description System Description
- 29. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • Test procedures • Results • Deviations / Exceptions Test of Controls / Results
- 30. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Intended Use • Management of service organization • User entities of the services • Other knowledgeable parties
- 31. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Considerations 05 ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 32. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Relevance To The User • RFP requirements • Customer mandates • Regulatory needs • Vendor management process
- 33. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Understanding Reporting • SOC 1 vs. SOC 2 • AT 101 • AT 601 • Agreed Upon Procedures • Readiness Assessment • PCI
- 34. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Education & Preparedness • Contracts, RFP, SLA • AICPA website • Training and awareness • Executive communication • Discussion with service auditor
- 35. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Control Environment • Start-up • Developing systems • No customers yet • Lack of documentation /evidence • No monitoring of controls
- 36. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Carve-out Vs Inclusive • Subservice organization • Carve-out method emphasis • Inclusive method requirements
- 37. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Perform a risk assessment Risk Assessment & Scope
- 38. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • Internally • Service auditors Readiness Assessment
- 39. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • Policies / Procedures • Segregation of duties • Monitoring Remediation
- 40. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • Licensed CPA firm • Independent • Single vendor approach • Audit team Audit Firm Selection
- 41. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved Mapping to Other Standards 06 ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved
- 42. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved • SOC 1 • ISO 27001 • HIPAA • HITRUST • PCI Other Standards
- 43. ©2015 BrightLine CPAs & Associates, Inc. All Rights Reserved View the WebinarView the Webinar