To help you secure data across the environment of its use, DataBrass uses a unified privacy enforcement and risk management approach.

• Determine which sources are relevant and whether or not each person's privacy needs are met.
• Integrate privacy enforcement standards, minimise compliance requirement sets, and classify outliers by jurisdiction.
• Create a privacy programme charter and organisational framework with specific goals, functions, obligations, and authorities, as well as a model for cross-functional collaboration.
• Conduct a privacy impact assessment, as well as an enforcement and controls assessment, as well as a security assessment that includes data centric controls evaluation.
• Gain a thorough understanding of data subjects, their jurisdictions, and how their information is processed, stored, used, and transferred. Separate PII variations and data for special handling.
• To secure data storage based on classification levels, develop and systematically enforce privacy and data security policies, processes, procedures, and information protection requirements.
• A public privacy notice informing data subjects about the data obtained, used, and exchanged, as well as their data rights.
• Use technology solutions for data classification, data leakage prevention, and information rights management to limit data access to approved users.
• Implement technology-based data classification, data leakage prevention, and information rights protection strategies.

Increasingly, businesses are looking for ways to outsource critical functions in an effort to reduce cost. But beyond cost management, outsourcing can also lessen burdens on in-house staff, freeing employees to focus on more important projects. Yet as these business functions and their associated data shift over to third-party SaaS or cloud computing providers, companies are faced with a growing risk of data theft and extortion along with costly liability should there be a data breach. So how can they protect their reputation, their integrity, and the security of their customer’s sensitive data while still reaping the benefits of outsourcing?

The SOC 2 audit is one important step toward offering that assurance to businesses who use cloud or SaaS providers. The SOC 2 audit is a service organization control compliance standard that evaluates policies and processes in place to protect a client’s data when it’s transmitted, stored, and managed in the cloud. The audit also looks to see that controls are in place for ensuring system and data availability. Service organizations earning SOC 2 compliance meet an elevated level of trust criteria.

SOC 2 compliance is an esteemed designation offered to organizations that pass the SOC 2 auditing procedure. This audit is conducted by outside, impartial auditors and was developed by the American Institute of CPAs, or AICPA.

To earn SOC 2 certification, a service organization must meet the following five trust service principles.

Security. SOC 2 auditors will assess policies, processes, and controls that have been put in place to protect systems from unauthorized access. Access controls might include intrusion detection, firewalls, or two-factor authentication. These security measures are intended to prevent system breach, hacking, and unintended disclosure or alteration of data stored in the system.

Confidentiality. Auditors will also evaluate safeguards that have been put in place to protect confidential data during storage. Confidential data might include intellectual property, proprietary business data, legal documents, transaction details, or engineering plans—essentially any information restricted to a certain person or group. Controls can be put in place by a cloud or SaaS service provider to block unintended access to any confidential data while it’s being transmitted or stored in the system. This might include firewalls, encryption, or access controls along with policies for identifying confidential data, retaining it for a set period of time, and erasing or destroying that data after the retention period has expired.

Privacy. How a service provider safeguards personally identifiable information is also part of an SOC 2 audit. Personally identifiable information encompasses any details that might identify an individual. For example, this might include their name and address, their race, sexual orientation, religion, or social security number. It also encompasses sensitive health records, credit details, and financial information. SOC 2 auditors assess the system’s ability to maintain privacy of that personally identifiable information during storage, transmission, use, and disposal. Auditors will also look to ensure an organization meets the promises set forth in its privacy policy and that it complies with AICPA’s own generally accepted privacy principles.

Availability. SOC 2 compliance requires that a service provider’s product or solution operates at the minimum performance levels promised in their service level agreement or contract. This covers both network availability and incident handling. Some areas an auditor might investigate include a company’s handling of security incidents or its disaster recovery processes. Controls in place to safeguard availability might include detection measures, environmental protection procedures, or routine testing of back-up system integrity.

Processing integrity. Finally, auditors evaluate how well a system achieves its intended objective. This means not only its ability to deliver the right information in a timely manner but also that the data is complete, valid, authorized, and that it accurately reflects the data a user entered originally into the system. Processing integrity might be compromised if, for example, there are duplicates when processing or if there are errors or inaccuracies in transactions that were submitted into the system.

SOC reports, short for Service Organization Control, were designed by the AICPA. There are two types of SOC 2 audit reports that a service provider can obtain, Type I and Type II. Both analyze controls that a service organization has in place to adhere to five trust service principles, specifically security, availability, process integrity, confidentiality, and privacy.

The SOC 2 Type I audit investigates that a company has internal controls in place for managing customer data based on five trust service principles as of a specified calendar date. It also looks to ensure those controls are designed appropriately to meet the service provider’s objectives. You can think of Type I as a snapshot in time.

While the SOC 2 Type I audit investigates that a company has controls in operation as of a specified date, the SOC 2 Type II audit delves further to investigate the operational effectiveness of those controls—assessing whether or not they performed as promised over a period of time spanning at least six consecutive calendar months

SOC 2 Type I and Type II compliance gives companies like SaaS providers, data centers, managed service organizations, banking and financial firms a powerful advantage over their competition. SOC 2 certification demonstrates that you value data security and have gone the extra mile—passing an independent audit to prove it.

SETUP MEETING WITH A SOC 2 EXPERT →

Our SOC 2 practice consists of three main areas. The three main areas consist of gap assessments, short-term audit assistance, and a complete SOC 2 management program. There are some organizations that may need to have a simple quick gap assessment to see if there are any controls lacking. There are others that prefer we handle all steps of the SOC 2 process on their behalf. No matter if you need us throughout the entire year, or just a short period of time, Cyber Security Services is your representative for all SOC 2 audits.

The SOC 2 GAP Assessment process is designed to detect any holes that could lead to a finding during the AICPA SOC 2 audit. The assessment is designed to document any control concerns, and get you on a fast path to resolution prior to the start of the audit period. Whether you are undergoing a SOC 2 Type I audit or a SOC 2 Type II audit, we can assist you with prioritizing controls.

The SOC 2 audit collection process can take a considerable amount of time for your team. We have a program designed to help with the evidence collection process. This is typically a few week engagement that is spread throughout the audit period. We represent you during the onsite review and the offsite document requests during the period. We complete many audits throughout the year, so we know exactly what the auditors need to meet their requirements. This ensures a smooth process from start to finish.

This program allows our team to work with you continuously during the audit period to meet all the control objectives. This includes everything from documenting current procedures that are in place as well creating new procedures. Cyber Security Services SOC 2 consultants will work with you throughout the period to ensure that any controls that are missing are quickly resolved. We have security experts that will assist with all control requirements. A few examples are firewall reviews, physical security reviews, policy development, user access reviews, HR procedures, business continuity plan development, security log monitoring assistance etc.. This is like having an additional member on your security team that is focused on meeting the SOC 2 objectives. Our complete program assigns a consultant to your organization on-demand and part-time to assist throughout the period. We are with you every step of the way throughout the year.

GET STARTED NOW →