Are you thinking about your SaaS product’s compliance requirements? More than likely, your prospects and customers are already quizzing you on your SOC 2 compliance. And you’re trying to come up to speed on what it is and what you need to do to get there. You may even have consumed so much information on the subject that you’ve reached that point that you’re simply confused and even a bit intimidated.
That’s precisely where this blog can help you — in sorting through the confusion. Sadly, there is a lot of misinformation circulating around the internet about SOC 2, and it’s not easy to separate the myths from the reality. Read on, and Akitra’s SOC 2 experts will bust some of the most common myths you’ll encounter.
Let’s get into it.
What is SOC 2 Compliance?
SOC 2 is a security compliance framework for companies that access, receive, or keep client data. It is intended to evaluate how a company secures and manages customer data at a single point in time (Type 1) or over a period of time (Type 2).
SOC 2 compliance not only helps businesses scale securely, but it also helps them develop trust with their customers with a SOC 2 report independently verified by an auditor.
But before you jump into the compliance journey, here’s busting a few myths for you — so that you know what you are getting into.
5 Myths About SOC 2 Compliance
Here are the facts about some common myths.
1. Myth: SOC 2 can be used to show compliance with various other compliance frameworks such as ISO 27001 and HIPAA
SOC 2 is the most common compliance framework in the US. While there is a high degree of commonality between SOC 2 and other compliance frameworks, they are certainly not identical in their criteria and controls. Being SOC 2 compliant does not imply that you are HIPAA compliant, for example. HIPAA is a government-mandated set of requirements for service providers that handle PHI (protected health information) and includes requirements for breach notification. SOC 2 is not mandatory and does not require breach notification.
Likewise, there are similar important differences between other frameworks.
2. Myth: SOC 2 has a set of standard controls that all companies must follow
Security, Availability, Confidentiality, Processing Integrity, and Privacy are the five categories of “Trust Services Criteria” in SOC 2. Of these, only Security is mandatory. An organization is responsible for putting in place controls that protect the data it handles and fit the requirements of the appropriate categories of criteria it opts to support. However, every company’s version of controls may differ for various reasons, such as the nature of its business, the kind of data it handles and the scale of the organization.
Given each company’s situation, an auditor from a Certified Public Accounting (CPA) firm will assess the design and effectiveness of the company’s controls during a SOC 2 audit to see if they match the applicable criteria in a reasonable way.
3. Myth: Instead of obtaining their own SOC 2 report, SaaS businesses can give their customers the SOC 2 report of their cloud services provider (e.g., AWS, AZURE, GCP)
Even if their SaaS application is hosted in the cloud – which is the norm for the current generation of SaaS companies – organizations must go through their own SOC 2 audit to acquire a SOC 2 report. SaaS companies and their cloud services providers participate in a “shared responsibility model” and so both parties bear responsibility for their part of the security burden.
4. Myth: A SOC 2 report is a one-time exercise
At its heart, SOC 2 is all about developing a security process, implementing it, and sticking to it. Typically, most companies initially seek SOC 2 Type 1 compliance to show that they are compliant at a point in time. This is very helpful in showing these companies’ customers that their service provider has a solid set of controls and evidence to prove it, as of the date of the audit. This can all be accomplished in a few weeks.
But to show that the company is actually sticking to its processes is a more demanding task. Continuous compliance requires continuous monitoring and continuous evidence gathering over a period of at least three months – and that is what a SOC 2 Type 2 report is designed to show. Thereafter, the audit of the company’s controls and evidence must be repeated periodically, typically once a year, to meet customer expectations that their SaaS provider has remained compliant.
The need for this kind of continuous, repeatable compliance process is one of the key drivers behind the steady abandonment of labor-intensive, manual compliance in favor of automated compliance services such as Akitra’s.
5. Myth: SOC 2 compliance is only about security
Security is at the core of SOC 2. It’s the main thing, but it’s not the only thing. It is well and good that companies implement appropriate technical security controls such as MFA, firewalls, password managers and so on. But SOC 2 also covers issues such as training, employee onboarding/offboarding, governance, codes of conduct, privacy and vendor management.
Simplify Your SOC 2 Readiness and Audit Process with Akitra’s Compliance Automation Service
With Akitra’s Andromeda Compliance automation solution, you can bid goodbye to your doubts and misconceptions — we make it a point to make compliance easy for you while also explaining SOC 2 so that it is not just a black box. With 95+ integrations with all the cloud platforms and SaaS services you are already using, Akitra provides continuous automated monitoring and evidence-gathering to make sure that you maintain continuous compliance. Your customers’ data is protected 24/7 throughout the year.
Check back in with us soon and follow the rest of this educational series about SOC 2, from Akitra, a leader in compliance automation platforms.
To book your FREE DEMO, contact us right here.
