How do I prove SOC 2 compliance?

For today’s cloud-based SaaS vendors that want to serve an enterprise customer base, SOC 2 compliance has practically become a must have. As enterprises see more pressure from customers and regulators to have strong cybersecurity practices, they’re passing that pressure on to their vendors. It wouldn’t make sense to go through the process of becoming compliant and building secure systems only to work with a vendor that doesn’t have the same standard for security, right? 

While it requires an upfront investment, becoming SOC 2 compliant can do a lot for a SaaS company. It aligns your business with an internationally recognized security standard — a fact you can use in your marketing and sales conversations. Plus, it streamlines the sales process, making it easier to share details about your security posture without having to fill out long questionnaires. And that means your sales team can leave your security team alone and let them focus on their core tasks.

Because of all this, SOC 2 compliance is likely already on your radar — but what does it take to become compliant? Below, we’re sharing a bit about the steps you need to take. 

The road to SOC 2 compliance

In very simple terms, the SOC 2 compliance process has three key components. First, a company creates a compliant cybersecurity program based on the level of compliance they want to achieve and the category that makes the most sense for their business. Second, the company must go through an audit conducted by an AICPA-affiliated CPA, which reviews and tests the relevant controls to the SOC 2 standard. The CPA then writes a report outlining their findings, providing an attestation of compliance. 

Sounds simple enough, right? Let’s dive in a little deeper. 

Step 1: Pick your variables

Before you even get started on building your cybersecurity program, you have to choose the type of compliance you want to achieve. For starters, do you want to be SOC 1 or SOC 2 compliant? If SOC 2 makes sense for you, will you need a Type 1 or Type 2 attestation? IS Partners provide a great overview of the differences on their blog, and they can be summarized as such: 

‍

‍

Ultimately, it comes down to the scope, the timing, and the types of controls you want to test.

The choices don’t stop there. For any company that wants to become SOC 2 compliant, there are also five trust criteria (or areas of focus) to choose from: security, availability, confidentiality, processing integrity, and privacy. While security is a must have (and confidentiality is highly recommended), companies can opt whether or not to be tested on the other three focus areas. When considering these remaining criteria, remember this: availability is important for any business that provides a mission-critical service that should be always on and processing integrity is key to any service that processes a lot of client data. When it comes to privacy, there are other standards, like GDPR and CCPA, that might be better to follow than SOC 2.

Step 2: Scope your audit

In addition to choosing what SOC report you’re aiming for and which criteria you want to test for, scoping your audit also requires determining which part of your business will be reviewed. Small companies will often scope the entire business, submitting all processes and tools to the review. Meanwhile, larger companies with multiple product lines can differentiate which parts of the business need to be audited. For example, if a company has both an enterprise product and a small business offering, they might only want to include the former in their audit. 

At this stage, you’ll want to have someone (either internal or external to your business) leading the SOC 2 efforts. This could be a compliance professional or an advisory team from a company that specializes in SOC 2.

Step 3: Identify any gaps in your cybersecurity program — and fix them

Once you know what controls you will be tested for, take a look at your cybersecurity program. Even if you’ve spent years developing it, there may still be a SOC 2 control that you haven’t accounted for. Here, the person responsible for SOC 2 can work with your security team — and everyone else in the organization — to ensure all the controls are met. 

Basically, the goal here is to ensure that the audit process is as smooth as possible, without any back and forth required to address any lacking controls. 

Step 4: Document everything

As part of your audit, your auditors will need to review any documentation and policies you have around your cybersecurity program. This is important to prove that there is an embedded culture of security within your organization and that there is a system in place to ensure compliance from your employees.

Step 5: Choose your auditor

Your auditors are going to be a team of people that you work with very closely, so it’s important to take your time to choose them. For starters, we recommend looking at teams that have experience doing SOC 2 audits for companies that have built a reputation for sound practices. Experienced auditors in this space are open to sharing advice, best practices, and next steps around anything they find lacking, so finding a team that’s done this many times before is key. 

Other factors to consider include: 

• Cost
• Availability
• Whether they provide a readiness assessment
• Project management skills
• Openness to collaboration

Step 6: Begin the audit — get the attestation 

Once you have an auditor in place, the audit process can begin. This is a thorough process that may take time and some back and forth to sort out any issues — but it’s worth it. At the end of the audit, if all goes well, you’ll have a SOC 2 report that you can make available to prospects and customers. 

Once you become compliant and receive your report, it’s important to remember that your SOC 2 report isn’t shareable for public consumption. Any time you want to share the report, you need to have the recipient sign an NDA and then use secure channels to share the document. This is where a tool like Pima can come in handy. You can use the tool to have people sign their NDAs digitally and automatically get access to the report. Plus, Pima automatically watermarks the document for you. And the dashboard gives you visibility into who is accessing which documents.

‍

Need a way to share your SOC 2 report with potential customers safely? Pima makes it easier than ever. Learn how.

‍