Professional Documents
Culture Documents
Deloitte SOC2
Deloitte SOC2
SOC 2 Overview
SOC 2 in a nutshell 3
Benefits of a SOC 2 4
Contact information 20
2
SOC 2 in a nutshell
There is an ever-increasing demand for companies to provide SOC 2 reports to their
customers and business partners. Many companies require a SOC 2 as part of a new
contract or contract renewal process (especially U.S. based companies). Customers are
requiring the formal documentation and independent assurance provided by a SOC 2
report and service organizations are seeing the commercial advantage of being able to
state that they have a SOC 2 report.
3
Benefits of a SOC 2
Obtaining a SOC 2 report requires investment both in terms of time and cost for an organization.
However, the advantages of getting a SOC 2 attestation are far more than the initial investment. Third
party organizations that successfully complete a SOC 2 audit can offer their clients reasonable assurance
that an independent reviewer has assessed their controls that relate to operations and compliance; and
they meet the criteria prescribed by AICPA for the five TSCs. The report helps to prioritize risks in order to
ensure that high quality services are being delivered to the clients. Essentially, a SOC 2 report is a tool
that can give organizations a competitive advantage and open up their market to new industries.
✓ Commercial advantage: In sales situations, TPA ✓ Confidence: Increased confidence that the vendor
reports can be one of the items which is meeting the internal control expectations of their
differentiate one service organization from its customers through independent and transparent
peers/competitors. It may also be seen as a reporting on operational effectiveness of controls
disadvantage if the OSP does not have such a at the supplier
report, but their competitor does.
✓ Internal reporting requirements: Ensuring that the
✓ Cost savings: Providing TPA reports, which company’s multi-purpose reporting requirements
require one audit team for a predictable period — including operational and financial—are met
of time, is generally more cost effective than
participating in customer audits. Customers ✓ Valuable insight/monitoring: Independent
receiving TPA reports are often required to pay assessments of whether the controls of the OSP
for the reports, further reducing the cost burden were in place, suitably designed and operating
of internal control testing. effectively, with a focus on continuous
improvement when controls are found to be lacking
✓ Broad assurance: Most TPA reports provide
reasonable assurance to a broad range of clients ✓ Cost savings: OSPs may charge customers for TPA
with a single report. reports, or they may not. The cost of being required
to pay for a TPA Attestation report should be
✓ Compliance requirements: Demonstrates to weighed against the cost of the customer having to
regulatory bodies that controls are in place and maintain their own staff or hiring staff to be able to
operating effectively. perform regular audits of the supplier(s).
✓ Improve overall control awareness: The process ✓ Compliance requirements: Maintaining compliance
of developing and issuing a TPA report at an OSP with industry, governmental and other relevant
often generates increased internal control regulatory requirements
awareness within the organization.
4
What does it take to develop and issue a SOC 2?
Each of our SOC 2 engagements has roughly followed the same process. We have found that it is important
to spend enough time up-front to get the scoping of the report right, develop a detailed plan of action,
identify key stakeholders and make the practical arrangements. We have developed templates and,
although each client’s control environment is different, we have a good understanding of what types of
controls to look for.
Type 1 reporting
When the client is confident that any significant control gaps or weaknesses have been remediated, we
perform the final control walkthroughs and assessment of the design and implementation of the controls
necessary to produce the Type 1 version of the report. Most clients begin their SOC 2 process by issuing a
Type 1 report with Type 2 reports for the future periods starting with the as-of date of the Type 1.
Type 2 reporting
When issuing a Type 2 report, we perform tests of the controls covering a period of time (at least 6
months), general from 01. January through to 31.December. These detailed tests are performed using
internationally accepted audit sampling guidelines, which are designed to provide reasonable assurance
that errors would be identified in the sample, if relevant.
Ongoing improvement
Discussing lessons learned with the client, tracking areas for future improvement with the report or our
audit methods and regularly assessing the quality of our work ensures that our engagements and reports
are of the highest quality.
5
Components of a SOC 2 report
Section II: Management is required to provide a written assertion about whether, in all material
Management’s respects and based on suitable criteria:
assertion • Management’s description of the service organization’s system fairly presents the service
organization’s system that was designed and implemented as of a specified date
• The controls stated in management’s description of the service organization’s system
operated effectively throughout the specified period to meet the applicable trust services
criteria
• Management must have a reasonable basis for its assertion. Standards provide flexibility
in the actual procedures performed by management. Management may not rely solely on
the testing done by the service auditor.
Section III: Section III: System Description Overview (provided by the service organization)
Description of the • This information will be provided by the service organization
system (provided by • A system consists of five key components organized to achieve a specified objective. The
the service five components are categorized as follows:
organization) o Infrastructure: The physical and hardware components of a system (facilities,
equipment, and networks)
o Software: The programs and operating software of a system (systems, applications,
and utilities)
o People: The personnel involved in the operation and use of a system (developers,
operators, users, and managers)
o Procedures: The automated and manual procedures involved in the operation of a
system
o Data: The information used and supported by a system (transaction streams, files,
databases, and tables)
• Applicability & Purpose of Report, System Overview, Entity level control information and
Complementary User-Entity Controls will also be included in Section III
Section IV: Trust • Trust services criteria, related controls (provided by the service organization), and tests of
services criteria, operating effectiveness (provided by the service auditor), testing matrix with mapping to
related controls and TSC
tests of operating • Topical Area System Descriptions (provided by the service organization), Testing and
effectiveness Results (provided by the service auditor)
6
Section III: Trust Categories
A SOC2 report may include any of the trust services categories of security, availability, processing
integrity, confidentiality, or privacy, either individually or in combination with one or more of the other
trust services categories.
For each category addressed by the engagement, all the criteria for that category should usually be
addressed. However, in limited circumstances, one or more criteria may not be applicable to the
engagement. In such situations, the one or more criteria would not need to be addressed.
Further, the common criteria (included in the Security trust services category) should be applied
regardless of which trust services category is included within the scope of the engagement.
• Security - Information and systems are protected against unauthorized access, unauthorized disclosure
of information, and damage to systems that could compromise the availability, integrity,
confidentiality, and privacy of information or systems and affect the entity's ability to meet its
objectives.
• Availability - Information and systems are available for operation and use to meet the entity's
objectives.
• Processing Integrity - System processing is complete, valid, accurate, timely, and authorized to meet
the entity's objectives.
• Privacy - Personal information is collected, used, retained, disclosed, and disposed to meet the entity's
objectives.
7
SOC 2 for supply chain
SOC 2 for supply chain
Manufacturers, producers, and distribution companies (referred to herein as “organizations”) must
manage a complex network of plants, service providers, and suppliers to operate efficiently and meet
commitments to customers. At the same time, the threats to and vulnerabilities of each supplier in the
chain have increased significantly. When a supply chain is disrupted, the organization is at risk of failing
to meet production or delivery commitments it has made to its customers.
• reputational damage,
• loss of intellectual property,
• disruption of key business operations,
• fines and penalties,
• litigation and remediation costs, and
• exclusion from strategic markets.
9
SOC 2 for supply chain (continued)
Managing supply chain risk of suppliers Objective of the SOC for Supply Chain reporting
Because of their dependence on suppliers, framework
organizations are responsible for understanding The objective of the SOC for Supply Chain reporting
the risks of doing business with suppliers and for framework is to provide a means by which
designing, implementing, and operating controls manufacturers, producers, and distribution companies
to mitigate those risks. For that reason, can communicate useful information about their
organizations are interested in, among other systems and the controls within the systems to
things, customers and business partners. CPAs can examine
and report on such information, thereby increasing the
confidence that customers and business partners can
• obtaining an understanding about the risks
place in the information.
identified by a supplier that affect the
supplier’s
• production, manufacturing, or distributions of
goods.
• comparing the supplier’s objectives for the
production, manufacturing, or distribution of
goods with customers’ needs.
• obtaining an understanding of the production,
manufacturing, or distribution process of a
• supplier to better understand the risks to the
customer of doing business with the supplier
and the controls that the supplier has
implemented to mitigate those risks.
• when establishing IT connectivity with a
supplier or business partner, understanding
the information security controls implemented
by the supplier or business partner in order to
more effectively integrate the security controls
of the two entities.
• Supplier-provided information
• Site visits, inspections, and other procedures
performed by the supplier’s internal audit
functions
• Assurance programs (such as International
organization for Standardization [ISO]
certifications) performed by third-party
assessors
• Provide a set of common criteria for disclosures about a manufacturing, production, or distribution
company’s system — Through the use of a common set of description criteria that set forth disclosures
about the system, the SOC for Supply Chain report reduces the information burden on organizations by
providing customers and business partners with useful information about the system and its controls to
help users better understand the associated risks and make better decisions.
• Provide a set of common criteria for assessing control effectiveness —The SOC for Supply Chain report
provides an independent assessment of the effectiveness of a manufacturer, producer, or distribution
company’s controls using the AICPA’s 2017 trust services criteria for one or more of the following
categories: security, availability, processing integrity, confidentiality, or privacy.
• Reduce the communication and compliance burden on organizations — The SOC for Supply Chain
report reduces the number of information requests from customers and the amount of information
sought if such requests are made.
• Provide useful information to customers and business partners while minimizing the risk of creating
vulnerabilities to the organization— Information provided in the SOC for Supply Chain report is
designed to meet the needs of customers and business partners without disclosing critical defenses
that might be targeted by malicious actors.
• Provide comparability — The SOC for Supply Chain report would provide customers and business
partners with information that could be used to track the progress of the organization’s supply chain
efforts across time and to benchmark those efforts against other organizations.
• Provide scalability and flexibility — The SOC for Supply Chain framework is useful to manufacturers,
producers, and distribution companies of varying sizes and across all industries.
• Evolve to meet changes — The SOC for Supply Chain framework will be updated and modified over
time based on experience, changes to the environment, and organization and stakeholder needs.
The SOC for Supply Chain framework leverages the core competencies of attestation providers as
providers of examination services, applying them to an organization’s supply chain efforts in accordance
with the AICPA’s Code of Professional Conduct and attestation standards.
• transparent,
• consistent across time,
• comparable between entities,
• reasonably complete,
• scalable, and
• flexible.
The SOC for Supply Chain examination could go far in meeting the information needs of customers and
business partners of manufacturers, producers, or distributors.
11
Deloitte’s Services
and
Reference Engagements
Deloitte’s Third-Party Assurance Services
Combined
SOC 1 &
ISAE 3402
Reports
SOC
SOC 2
Readiness
Reports
Assessments
ISAE 3000
GDPR – DPA
Attestations
• SOC1 & ISAE 3402 attestation – We deliver numerous ISAE3402 reports for customers each year and even have clients
where we issue a combined ISAE3402 and SOC1 report, increasing the useability of the report for their US customer base.
• SOC2 attestation – performed in accordance with AICPA issued Trust Service Criteria for Confidentiality, Availability,
Security, Processing Integrity and Privacy, we issue more than 10 SOC2 reports for Norwegian companies annually.
• ISAE 3000 Data Processing Agreement Attestation (GDPR Compliance) – we provide attestations to customers which are
used to evidence compliance with the terms outlined in their Data Processing Agreements.
• Third Party Risk Management (TPRM)– assisting clients in formalizing their third-party risk evaluation and mitigation efforts,
including methods to inventory third-party relations, classify the risk of each existing and any future third-party relations,
developing self-assessment questionnaires for covering varying risk themes (e.g., cyber, financial, climate and sustainability),
methods for reviewing responses and defining and executing audit procedures necessary resulting from the assessments.
• Vendor Reviews – using our vast experience in both auditing and assisting vendors with their internal control needs, we can
perform reviews of your vendors for you to provide you with assurance for specific risks you have identified or just follow
one of our specific vendor audit programs for specific topics.
• Sustainability Reporting attestation – we provide attestation reports on companies’ sustainability reporting as well as other
Climate and Sustainability related topics.
• SOC Readiness Assessments – We perform gap analyses and readiness assessments for all of the above topics. 13
Note: The names of our references
are made anonymous for this
brochure.
Deloitte engagement references
The following is a list of some of the engagements our Norwegian Team has worked on or are
currently delivering. We support engagements across the Nordic region, as indicated (NO, SE, DK).
• Payroll processing (ISAE3402 Type 2 - Payroll) • IT security services (SOC2 Type 2 – IT Services)
• SaaS provider (SOC 2 Type 2 – SaaS)) • Airline (ISAE3000 Type 1 – Process integrity)
• SaaS provider (ISAE3000 GDPR – SaaS) (DK) • SaaS provider (SOC2 Type 2 – SaaS)
• Telecom (ISAE3402 – Transaction processing) • SaaS provider (SOC2 Type 2 – SaaS)
• SaaS provider (ISAE3000 Type 1 – SaaS) (DK) • IT services (SOC2 Type 2, ISAE3402 Type 2 and
ISAE3000 GDPR – Managed IT))
• SaaS provider (ISAE3000 GDPR – SaaS) (DK)
• Financial services (SOC2+ with CSA CCM – Financial
• IT services provider (SOC2 Type 2 – IT)
services) (DK)
• SaaS provider (ISAE3402 Type 2 – SaaS) (DK)
• SaaS provider (ISAE3402 Type 1 – SaaS) (DK)
• Transportation services (ISAE3402 Type 2 – Ticket
• SaaS provider (SOC2 Type 2, ISAE3000 GDPR and
income distribution)
ISAE3000 for MitID and NSIS - SaaS)
• IT services (SOC2 Type 2 – IT) (DK)
• IT services provider (ISAE3402 / SOC1 combined
• Financial services (ISAE3402 Type 2 – IT) (DK) and SOC2 Type 2 – Data center services)
• Educational Institution (ISAE3402 Type 2 and • SaaS provider (ISAE3402 Type 2 and 3 ISAE3000
ISAE3000 GDPR (DK) GCPR – SaaS) (DK)
• SaaS provider (SOC2 Type 2 - SaaS) • IT services (Multiple ISAE3000 reports – Managed IT
• Financial services (ISAE3402 and multiple SOC2 Services)
reports – Financial services) (SE) • SaaS provider (ISAE3402 Type 2)
• IT services provider (ISAE3402 Type 2 – Managed
IT)
• SaaS provider (ISAE3402 Type 2 – SaaS)
14
SOC 2 Comparison
to
other standards
SOC 2 and ISAE 3402
The scope of an ISAE3402 report is more focused on the These two report types serve different purposes and
risks and internal controls related to the business have different focuses, scopes, uses, and target
processes and controls and general IT controls in place to audiences. Choosing the correct framework that best
ensure the complete and accurate processing of financial fits the needs of your customers, stakeholders and
transactions for their clients. their auditors is important. We have extensive
experience in making the right choice.
16
SOC 2 and PCI DSS
While both PCI DSS and SOC 2 audits are designed to ensure that
organizations protect sensitive data, they have different scoping, testing
strategies and levels of assurance. PCI DSS is geared towards compliance
with specific requirements for credit card data handling, while SOC 2 is
focused on the overall control environment of the organization, including
security, availability, processing integrity, confidentiality, and privacy.
Target audiences
A PCI DSS audit is focused on organizations that process credit card transactions and The target
audience for this type of audit would typically include companies in the retail, hospitality, and
financial services industries.
A SOC 2 audit is focused on organizations that handle sensitive data and provide services, such
as cloud providers and managed service providers. The target audience for this type of audit
would typically include technology and service companies. 17
SOC 2 and ISO27001
18
Contact Information
Contact information
Kevin F. McCloskey
Associate Partner, Third-Party Assurance Services
CISA, CIA, CIPP/e, CRMA
Mobile: +47 913 68 848
Email: [email protected]
Lasse Vangstein
Partner, State Authorized Auditor
Mobile: +47 975 84 086
Email: [email protected]
Jouni Viljanen
Partner, Risk Advisory
Mobile: +35 820 755 5312
Email: [email protected]
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee
("DTTL"), its network of member firms, and their related entities. DTTL and each of its member firms are legally
separate and independent entities. DTTL (also referred to as "Deloitte Global") does not provide services to
clients. Please see www.deloitte.no for a more detailed description of DTTL and its member firms.
Deloitte Norway conducts business through two legally separate and independent limited liability companies;
Deloitte AS, providing audit, consulting, financial advisory and risk management services, and Deloitte
Advokatfirma AS, providing tax and legal services.
© 2023 Deloitte AS
20