SOC compliance is useful in order to have perfect security solutions offered in any SaaS ( Software-as-a-service ) pertaining enterprise. SOC testing contributes to benchmark a company about the quality, it's clean processes which in turn increase customer's security.
Adhering to SOC makes SaaS providers work on perfect standards for cloud security, identity and access management, mobile security, vulnerability management and many more.
"Customers are worried about quality and not quantity........."
There are continuous changes in unanimously agreed on regulations and threats, which set sight upon the business of each and every size of IT industry. So the concern about risks of IT data security and compliance for organizations is growing for all SaaS providers. Search for perfect benchmarking has ended since SOC came into effect. Hence reducing the efforts of customers from buying cloud security products of the market.
SOC counts for adhering to the standard of security, and companies opt for it.
Need for SOC :
SOC compliance report benefits customers and company as well. Customers are assured about quality, thus their time of hunting for the vendor is settled down to zero.
SOC is set up by Auditing Standard Board (ASB) of American Institute of Certified Public Accountants (AICPA). SOC consists of trust service principle's (TSP) framework, for cloud security companies its cybersecurity risk management reporting framework, for evaluating organization's internal controls by meeting specific criteria found in cybersecurity based companies.
SOC is beneficial for customers as well as the company. This can be listed below.
- SOC testing contributes to benchmark a company about the quality, its clean processes which in turn increase customer's security.
- Developing more promising infrastructure is essential to increase security into technical processes, development, and design of security products.
- SOC assures the customers about privacy and protection of their data.
- Companies can deal with the existing and future customers with confidence and conveys them the trust about their choice of service opted for.
- A competative advantage in the market.
- If SOC is conducted the number of on-site audits are reduced and the customer queries can be solved.
What's SOC1, SOC2 and SOC3 ?
Service Organization Control (SOC) Reports are independent third-party examination reports that demonstrate how the company achieves key compliance controls and objectives. The purpose of these reports is to help you and your auditors understand the controls established to support operations and compliance.
There are three types of SOC Reports:
SOC1, SOC2 and SOC3.
The basis of SOC is based on how company secures customer data and how efficiently these controls are operating.
It provides an independent assessment of security and privacy control environment of a company. The assessment includes the description of controls, the test performed to access them, the results obtained on those tests and overall opinion of design and operational effectiveness of it.
SOC reports each one is of two types: Type I and Type II. Type I is on specific time and Type II is for a specific time duration (one year span).
SOC1, also known as SSAE No. 16, is the compliance issued by Auditing Standard Board (ASB) of the American Institute of Certified Public Accountants (AICPA). It sets check on company’s internal control over financial reporting. It describes, if the company's processes are according to cyber security trust principles.
To know more about system security and availability rather than financial reporting, SOC 2 and SOC 3 reports are needed.
SOC 2 compliance is inclined to the overview of the security service organization's (company's) system. It focuses on how to figure out if the design of control meets the benchmark of AICPA Trust Service Principles of Cyber Security. This reports on service organizations control, as on specified date and time. SOC 2 depends on testing all control criteria.
The Type II report discloses service organization's control over specific review period.
SOC 3 report covers the same testing procedures as a SOC 2 report, but it omits the detailed test results and is intended for general public distribution.
SOC aim’s to evaluate an organization’s hosted cyber security system and the data stored by the company or processed in reference to security, processes, availability, integrity, confidentiality or privacy.
The security principle implies to, how company's resources are protected against unauthorized access. Access controls help in prevention of potential system misuse, software ill-use, theft or unauthorized removal of secured data and inappropriate alteration or disclosure of information.
This can be overcome by implementing strong authentication, intrusion detection system and so on.
It is the accessibility of the Company's products. Some products or services may be used by a contract or service level agreement (SLA). The minimum to the mark performance level for system availability is set by both auditors and the company.
This include performance monitoring, security incident handling, disaster recovery and so on.
The processing integrity principle focuses on if a system achieves its purpose or not. For example, if it delivers the right data at the right price at the right time. Accordingly, secured data processing has to be complete, valid, accurate, timely and authorized.
This include quality assurance, processing monitoring and so on.
The access and disclosure of confidential data is restricted to a specified set of persons or organizations. This may include data restricted only for company personnel, as well as business plans, intellectual property, internal price lists and other types of sensitive financial information.
This includes encryption, access control, network's or application's firewall and so on.
The privacy principle implies that the company's collection, use, retention, disclosure, and disposal of personal information is restricted in accordance with organization’s privacy notice.
This points to access control, two-factor authentication, encryption and so on for cloud security solutions.
The documentation consists of policy & procedures, narrative descriptions of the controls, organizational charts, business flow-charts, and functional diagrams. These are needed to represent not just the control objectives, but also the detail of the control specifications and the overall system of the control design.
An assertion will be provided for the auditor also as either part of the description of the overall control design (system) or as a separate document. This documents to predict the details of management’s understanding (Management Assertion) of the monitoring and operating effectiveness of the system over the relevant testing period for attestation by the auditor.
For example, physical security controls, change management systems, systems and software development life cycles (SDLC), and disaster recovery are the tools and processes used in Cloud security.
When documenting begins for your business process lifecycle, the key areas where critical elements take root are identified. Certain activities along with supporting policies, procedures, and processes that begin to define company's control environment are noted. The company can then begin to formalize control objectives and their supporting control elements.
There are certain norms which every company has to fulfill in order to go through SOC audit.
Norms of SOC 1, SOC 2 and SOC 3
|Description of the Company’s System and its assertion || |
The motive of system description and its assertion is to provide client and their auditors a complete insight into internal control environment. A complete description of company's system like is it only cloud security or with connector services. The system description mostly comprises of key processes, and control objectives, along with the flow of transaction data from initiation to the point where it is delivered or reported on.
The processes used for running the System like waterfall, agile (scrum), iterative, incremental developmental and other methodologies, its assertion is needed, with due completion and accuracy.
Controls mostly consist of security and access, program development, and change management, as well as computer operations backup and recovery, (Disaster recovery, however, should not be included in the scope of a SOC 1 report as it is not relevant to internal control over financial reporting). For example, data loss prevention (DLP), firewalls, IPSs are some of the controls. It is required to be mentioned in a SOC 2 report on security, availability, processing integrity, confidentiality, or privacy related to cloud security products.
Control objectives may include controls providing reasonable assurance that automated and manual controls are in place and utilized for initiating transactions for client data. These can be IT value management, business-IT alignment, IT strategic plan, portfolio management, technology infrastructure plan, and so on.
Many other details about system like identity and access management in the cloud environment, location of the enterprise’s data, management of security of the enterprise’s data, the disaster recovery capabilities, management of privileged user access to data, protection of enterprise’s information from user abuse, and so on are the details mentioned in SOC report.
| ✔ |
|Acknowledgement and attestation|| Acknowledgement and attestation for all supporting documents which provide a reasonable basis for assertion are needed like how many years the system is being followed, the availability of system requirements, their licenses, the records with proofs, the attested regular audit sheets and so on. || ✔ |
| Selection of criteria of testing||There has to be a prediction in written form about the criteria of testing. Pen testing is done normally for cloud security products. Testers use WAF (web application firewalls) data such as logs, to locate weak spots. From this test, the detected vulnerabilities such as unsenitized inputs that are susceptible to code injection attacks are tested and patched. This counts for SOC.|| ✔ |
|Control objectives||Control objectives in the description of company's system are to be mentioned. |
Here are some control objectives which a company may have:
IT value management, business-IT alignment, IT strategic plan, portfolio management, technology infrastructure plan, and so on.
Controls provide a commitment that batch processing transactions are according to rules, result in accurate output data, and activities for increasing compatibility are undertaken to confirm the perfection.
In reference to security products, this may include the deployment of plug-ins, its relevant compatibility with the app is checked and improved.
| ✔ |
|Identification of risk||Risk engaged in implementing control objectives should be predicted along with identity designing, implementing and documenting controls, which are suitably designed and are operating effectively to provide reasonable assurance. || ✔ |
|Access to records||Records and documentation including service level agreements relevant to the description of company's system should be accessible.|| ✔ |
|Unrestricted access for personnel||Relevant evidence for the examination should be accessible to the personnel that is the representative of the third party and is a mediator to achieve SOC compliance. Some evidence serve as a backup for compliance verification.|| ✔ |
|The written assertion for user entities||Written assertion of company's description of its system is needed, it should in a condition to be provided for user entities.|| ✔ |
miniOrange believes in setting appropriate processes, security standards which are according to SOC compliance and audit. Adhering to these standards offers more promising and secure solutions for the customers.
Amazon Web Services (AWS) - provides the infrastructure that hosts miniOrange’s Identity-as-a-Service platform. AWS SOC 2 report is available here: https://aws.amazon.com/artifact/