SOC Training
SOC Training
SaaS
+ PaaS
IaaS
SaaS – PaaS - IaaS
Customer
Responsibility
IaaS – Infrastructure as a Service (AWS, Rackspace)
Cloud Provider PaaS – Platform as a Service (Engine Yard, Heroku)
Responsibility
SaaS – Software as a Service (SalesForce.com, Zendesk)
What is SOC Reporting?
• Not SOX!
• SOC – Service Organization Control reporting
• Attestation standards issued by the AICPA for service providers
• Replaced the old SAS 70 standards in 2011.
• Three report versions:
SOC1 (SSAE16)
SOC2
SOC3
What is the Catalyst for doing a SOC Report??
SOC Reporting Participants
Potential Customer
What is a SOC 1 Report?
The system is protected The system is available for Information designated as System processing is This principle addresses the
against unauthorized access, operation and use as confidential is protected as complete, valid, accurate, system’s collection, use,
use, or modification. committed or agreed. committed or agreed. timely, and authorized retention, disclosure, and
disposal of PII in accordance
28 common criteria with commitments and system
(required) 3 additional criteria 8 additional criteria 6 additional criteria requirements.
20 additional criteria
• COBIT5
• NIST 800-53
What is a SOC 3 Report?
• A SOC 3 report is a general use report that provides only the service auditor’s
report on whether the system achieved the trust services criteria (no description of
tests and results or opinion on the description of the system).
• SOC 3 reports can be issued on one or multiple Trust Services Principles (security,
availability, processing integrity, confidentiality or privacy).
SOC Reports
Type I vs. Type II
Type I Report
Report of the design of the controls at a point in time. Typically utilized for first-time issuers,
at the conclusion of the readiness phase, and as a pre-cursor to the Type II report.
Type II Report
Report of the design and operating effectiveness of the controls over a specific period of
time (minimum of six months, maximum of twelve months). A Type II report is what is
expected by business partners, enterprise customers, and their auditors as the procedures
are sufficient to replace the due diligence and security assessment they would otherwise
have had to perform.
How to Prepare for a SOC Report
SOC Report Key Considerations
www.theCadenceGroup.com
http://www.linkedin.com/company/the-cadence-group
801.349.1360