[Day 4] 1. System and Organisations Control (SOC)

Introduction

• SOC in compliance refers to System and Organisation Controls, distinct from Security Operations Centre (SOC).
• It is a framework developed by the American Institute of Certified Public Accountants (AICPA) to assess and report on an organisation’s controls.

Purpose of SOC

• To provide assurance about the internal controls of service providers to clients and stakeholders.
• Includes assessment of both financial condition and data handling practices to ensure service continuity and reliability.
• Example: Ensuring a service provider’s financial stability to avoid disruption if they face bankruptcy.

Types of SOC Reports

1. SOC 1: Financial Report

   • Focus: Controls relevant to financial reporting.
   • Audience: Specific clients who rely on the organization for financial operations.
   • Availability: Not publicly disclosed, provided only to clients or stakeholders upon request.

2. SOC 2: Security Audit Report

   • Focus: Covers Trust Service Criteria:
     • Security
     • Availability
     • Processing Integrity
     • Confidentiality
     • Privacy
   • Audience: Clients or stakeholders who need assurance of secure data handling.
   • Availability: Not publicly disclosed, detailed report given only to relevant parties.

3. SOC 3: High-Level Summary of SOC 2 Report

   • Focus: Public-facing summary of SOC 2, providing general assurance.
   • Audience: General public or external stakeholders.
   • Availability: Publicly disclosed, but only includes information appropriate for public knowledge.

Relevance in Compliance

• Understanding SOC reports is vital for evaluating the trustworthiness and reliability of service providers.
• SOC 2 is particularly important for cybersecurity and compliance professionals, as it addresses controls related to data protection and privacy.

In Interviews

• What is SOC in compliance?

  • SOC stands for System and Organization Controls, a framework developed by AICPA to ensure service providers meet specific standards.

• Differentiate between SOC 1, SOC 2, and SOC 3:

  • SOC 1: Financial controls, for clients only.
  • SOC 2: Security and trust controls, for clients only.
  • SOC 3: Public summary of SOC 2, for general audiences.