If your business model involves storing customer data in the cloud, you’re strongly incentivized to meet SOC 2 compliance standards. This AICPA (American Institute of CPAs) compliance regime was designed specifically so that SaaS companies have a set of uniform standards to conform to when designing their security apparatus. Since most software companies are now SaaS companies by default, interest in passing SOC 2 audits has never been higher.
Passing a SOC 2 audit is an important differentiator for your business. Even though SaaS businesses have exploded over the last few years, less than 20% of SaaS companies are SOC 2 certified. This means that in a strongly competitive environment, SOC 2 certification is an important differentiator.
How do you Pass SOC 2?
Setting up and passing a SOC 2 audit is not simple. Beginning a SOC 2 audit means contracting an external auditor and assessing the extent to which your organization complies with the following principles:
- Security
Can you prevent attackers from breaking into your critical systems? Auditors will be looking for the consistent application of technologies such as multi-factor authentication, nested perimeters, SIEM tools, and other solutions that can prevent and alert on intrusions or misuse of privileges. - Availability
This discusses whether you can meet your SLAs, particularly with regard to security. In the aftermath of a disaster or a data breach, can you restore files, perform forensics, and keep your platform up and running? - Processing Integrity
As a SaaS company, you will be handling a lot of sensitive data. SOC 2 wants to know if that data makes it to the right place. Once your users or customers place their PII into input forms on your website, do you then have a known good procedure that will deliver that data to secure storage? Do you have a way to know if it doesn’t? - Confidentiality
Once personal data ends up in secure storage, you need to put procedures in place to make sure that only a few people can access it. It is then considered confidential. The procedures you need may take the form of additional firewalls and access controls, plus encryption both in motion and at rest. - Privacy
This refers to the way in which you collect personal information, use it in your platform, notify your users that their information has been collected, and ensure that the information that is no longer needed is destroyed. Not all personal information falls under the same privacy standard – some data is considered more sensitive and requires stricter controls.
Adhering to these five principles is a great way to make sure that your SOC 2 audit goes off without a hitch – but it’s not a guarantee. Auditors don’t just want to see that you have these policies in place. Rather, they want to make sure that they apply to everyone across the organization. For a more thorough Type 2 SOC 2 audit, they’ll want to confirm that your policies will work over a long period of time.
Avoid SOC 2 Pitfalls with Device 42
There are more than a few ways to fail your SOC 2 audit. For example, you might not be able to demonstrate the ability to show that your applications are up to date and regularly patched. This is a security failure in the eyes of SOC 2, because any unpatched application is a security threat.
You might also fail to provide documentation. Without documenting your applications – or at least the specific applications that you use to run security – your auditors can’t see what you’re protecting or what you’re protecting it with.
Lastly, you might be unable to show that you’re sequestering your most personal data. You should be able to point to every data store that holds PII and be able to demonstrate that only a small number of people are able to access it. Without this reassurance, you’ll likely fail your audit.
Device42 can help by drastically shrinking the amount of effort it takes to provide documentation for your SOC 2 audit. Instantly generate a list of applications and version numbers to validate your patch program. Produce a map of web servers and their dependencies. Find every database on your network. With these tools, you’ll be able to show not only that you’ve been putting security programs in place, you’ll be able to demonstrate that you’ve made them work for the long haul.
For more information, contact us for a free trial today!
