Why You Need a SOC 2 Certified Vendor

In the past few years, many major companies like eBay and Yahoo have been in the news for information security breaches. Now that cyber criminals are becoming increasingly proficient at lauching cyber attacks, it is essential that you start prioritizing SOC 2 Type I and SOCI II certifications. Here is some information about why you need a SOC 2 Type I & II certified vendor.

What Is SOC 2 Compliance?

All organizations are concerned about information security, and for good reason. Even organizations that rely on third-party vendors for SaaS, cloud computing, and other services always have information security on their mind. If data is mishandled by network security and application providers, it can cause enterprises to become vulnerable to malware installation, extortion, data theft, and other attacks.

SOC 2 refers to an auditing procedure that is intended to ensure that service providers handle your data properly to protect your organization's interests and the privacy of your clients. If you care about security, SOC 2 compliance should be one of the most important factors you consider when selecting a SaaS provider.

SOC 2 was developed by the American Institute of CPAs (AICPA). The criteria defined by SOC 2 for the management of customer data are based on the following five principles: privacy, security, confidentiality, availability, and processing integrity.

While PCI DSS has very strict requirements, SOC 2 reports differ from organization to organization. Each organization creates its own controls to comply with the principles listed above. The controls are based on the organization's business practices.

The purpose of the internal reports is to provide regulators, suppliers, and business partners with vital information about your service provider's practices when it comes to managing data.

SOC reports come in two forms:

  • Type I describes the systems of the vendor and whether the design is sufficient to fulfill trust principles.

  • Type II describes the operational effectiveness of the systems.

What Is SOC 2 Certification?

Outside auditors issue SOC 2 certification. They evaluate how much a vendor complies with the five trust principles based on the processes and systems in place. Here is some information about the five trust principles:

The Security Principle

The security principle involves the protection of systems resources against access by unauthorized individuals. Access controls are intended to prevent misuse of software, system abuse, theft or unauthorized removal of data, and improper disclosure or alteration of data.

Some examples of IT security tools commonly used to ensure the security of systems include network and web application firewalls (WAFs), intrusion detection, and two factor authentication.

The Processing Integrity Principle

The processing integrity principle concerns whether a system is successfully functioning as intended. All data processing performed by the system must be authorized, complete, timely, precise, and accurate. However, processing integrity does not encompass data integrity.

The processing integrity is not responsible for detecting errors that exist in data prior to being entered into the system. Quality assurance procedures and the monitoring of data processing are both needed to ensure the fulfillment of this principle.

The Confidentiality Principle

Data is viewed as confidential if only a certain group of people or organizations are able to access or disclose it. Internal price lists, business plans, intellectual property, and financial information are examples of data are frequently considered confidential.

Confidentiality during transmission of data is ensured through encryption. Organizations use application and network firewalls along with access controls to protect information being stored or processed on computer systems.

The Privacy Principle

The privacy principle involves the collection, disclosure, retention, use, and disposal of personal information in accordance with the privacy policies of the organization. This principle also emphasizes the criteria in the generally accepted privacy principles (GAPP), which are published by the AICPA.

Personal indentifiable information (PII) refers to information that can make it easy to identify an individual. Examples of such information include name, address, and Social Security number. Personal data related to religion, race, sexuality, and health are also viewed as sensitive and often need to be protected. Organizations must put controls in place to prevent unauthorized users from accessing PII.

The Availability Principle

The availability principle refers to a system's accessibility as mandated by a service level agreement or contract. It can also refer to the accessibility of products and services. The system availability performance level is set by all parties involved.

Usability and functionality are not relevant when it comes to the availability principle. However, it does involve criteria related to security that may impact availability. Some important factors are site fail-over, network performance and availability, and security incident handling.

Why You Need a SOC I & II Certified Vendor

More and more vendors across many different industries are proudly advertising their SOC 2 certification. After, it is not fast or cheap to go through the SOC 2 Type II certification process. The process can take anywhere from six months to year and can cost $30,000 to more than $100,000. The cost and amount of time needed to complete the process depends on the infrastructure's complexity. Vendors that get SOC 2 certification show that they have the time, patience, and money to dedicate to information security.

While this is certainly a major achievement, many organizations don't understand why. If you play a role in vendor sourcing, it is particularly important that you understand the significance of SOC 2 certification.

All companies transitioning to the cloud for data storage are concerned about the security and integirty of their sensitive information. This includes your vendors. SOC 2 Type I and II certifications will provide you with assurance that your vendor's cloud platform is secure and safe.

Cyber criminals are becoming more and more intelligent and information security breaches are quickly becoming commonplace. As you can see, in this day and age, it is essential that you hire a SOC I & II certified vendor. For more information about the importance of SOC I & II certifications, don't hesitate to contact us.

About the Author: Jeff Poirior

Jeff brings 25 years of telecommunications and information technology management experience in voice and data networking, server support, and telephony and security; with a significant emphasis on customer service. Prior to joining Valicom, he was chief of the infrastructure support section for the Wisconsin Department of Transportation. Jeff was the vice president of operations for CC&N, overseeing telecommunications, help desk, data and desk side support services. Prior to that, he served as the associate director of technical resources for Covance, responsible for managing systems and network operations supporting 1700 users in Wisconsin and Virginia. He has also led data center operations at Magnetek Electric, supporting mainframe systems, client/server applications, telephony systems, and computer-aided design. Jeff holds a bachelor’s degree in business administration from Cardinal Stritch University and a master’s degree in business administration from University of Phoenix. In addition, Jeff is a past board member of the Wisconsin Telecommunication Association.