<blockquote class="editor-quote ltr" dir="ltr">SOC 2 is NOT a certification. SOC 2 is an Attestation.</blockquote><ul class="editor__ul"><li value="1" class="editor__listItem ltr" dir="ltr">The issued report does not have an expiration date.</li><li value="2" class="editor__listItem ltr" dir="ltr">Every control may not be operating effectively and the report will still be issued.</li><li value="3" class="editor__listItem ltr" dir="ltr">CPA firms render their opinions; they do not grant certifications.</li></ul>There is no requirement to “maintain” your SOC 2 report year over year. The above are characteristics of a certification. A SOC 2 report is actually a form of attestation whereby a CPA firm will issue a report containing an opinion on whether or not the service organization’s controls were suitably designed and/or operating effectively to meet criteria classified into one or more Categories: Security, Availability, Confidentiality, Privacy, and Processing Integrity. While the Security (a.k.a Common Criteria) category is required, the others can be scoped in depending on the organization’s service commitments and system requirements. The report can be either as of a specific date (Type 1 report), or over a specified period of time (Type 2 report). The key takeaway here is that the CPA firm performing the SOC 2 audit does not issue a “certificate” as part of the SOC 2 attestation process.<blockquote class="editor-quote ltr" dir="ltr">A SOC 2 report is solely focused on IT or security-related controls.</blockquote>IT-related or security controls by themselves will not be sufficient to&nbsp;achieve a clean SOC 2 report. The SOC 2 Trust Services Criteria also requires controls addressing COSO Principles, which focus more on overall company governance, ethics, and culture. This includes “tone at the top” controls such as implementation and dissemination and acknowledgement of the appropriate policies, code of conduct, and employee handbook, and the organization’s ability to attract, develop, and retain employees. Additionally, the organization will need controls over risk identification and assessment, risk mitigation, control activity monitoring, and its vendor management program. Understanding the broader nature of the audit will assist companies in implementing the relevant controls to undergo a SOC 2 examination successfully.<blockquote class="editor-quote ltr" dir="ltr">&nbsp;The number and types of SOC 2 controls are mandated.&nbsp;</blockquote>The entity undergoing the SOC examination will need to determine the appropriate number and type of controls required to meet the AICPA Trust Service Criteria depending on the categories in scope. As a general rule, the criteria are written in a way that allows flexibility in determining which controls at a particular organization should be put in place to meet them. The Trust Service Criteria are supported by&nbsp;Points of Focus&nbsp;that are meant to serve as guidance for both the organizations and auditors. However, an organization is not required to implement controls for each point of focus specified, only those it deems relevant.<blockquote class="editor-quote ltr" dir="ltr">The SOC 2 Type 2 audit is an annual examination.&nbsp;</blockquote>As mentioned previously, a SOC 2 Type 2 report covers a period of time. 12 months is the most common, but there is no minimum required duration — although typically, the shortest period a CPA firm will accept to audit is three months. There are several scenarios where a duration shorter than a year would make more sense for the entity. For example, a company undergoing a SOC 2 readiness assessment in the middle of the year may require a six-month report for the ending period of the audit to align with their year-end or their customers’ fiscal year. Going forward, they could then keep a 12-month reporting period to maintain continuous coverage for their readers.&nbsp;<blockquote class="editor-quote ltr" dir="ltr">Cloud Provider SOC 2 report is sufficient in place of undergoing their own examination </blockquote>Many organizations believe they can have full coverage over their environment by obtaining their service providers’ SOC 2 reports. While obtaining their SOC 2 reports does provide some coverage, often organizations are only responsible for a subset of controls. Due to the shared responsibility model, there are controls that the users of these services (in this case, the service organization itself) will need to perform on their end, and thereby will need to undergo its own examination. This includes controls in place over its use of the cloud/infrastructure service, such as restricting logical access to the appropriate individuals.In this instance, the IT infrastructure provider will count as a subservice organization, and the SaaS service organization will&nbsp;typically&nbsp;use the ‘carve-out’ method to exclude the subservice organization’s controls from its own SOC 2 report.&nbsp;

Picasso debunks common myths and misconceptions. SOC 2 is the “gold standard” for reporting on information technology (IT) control environments for service organizations.

Common Myths about SOC 2

ShortIdPostQuery

query ShortIdPostQuery(
  $shortId: String!
) {
  home {
    blogPost(shortId: $shortId) {
      id
      title
      tags
      publishedAt
      richTextContent {
        contentHtml
      }
      ...PostView_record
    }
  }
}

fragment PostView_record on BlogPost {
  id
  title
  summary
  publishedAt
  category {
    id
    name
  }
  richTextContent {
    content
    contentHtml
    formatVersion
    format
  }
}


ComplianceCommon Myths about SOC 2