SERVICE ORGANIZATION CONTROL (SOC) 2SOC is a suite of reports from the American Institute of Certified Public Accountants (AICPA) that CPA firms can issue in connection with system-level controls at a service organization. SOC 2 reports on various organizational controls related to the five categories of the Trust Services Criteria (TSC): Security, Availability, Confidentiality, Processing Integrity, and Privacy.
If your organization stores or transmits potentially sensitive data on behalf of clients, earning SOC 2 certification (SOC 2 Type I or Type 2 Reports) is an important step–both legally and competitively. The types of organizations that should comply include SaaS providers; companies that provide business intelligence and analytics; businesses that oversee, facilitate, or consult with finances or accounting practices; cloud service providers; and those that store client information in the cloud.
Determining the best Trust Services Criteria (TSC) to include in your SOC 2 audit is an important decision—and we can help you make it. We’ll help you get a stamp of approval that shows your company can securely handle confidential data.
The Security Category (also known as “common criteria”) refers to the protection of information throughout its lifecycle. This is the only category that is required. Security controls are established to protect against unauthorized access, unauthorized disclosure, or damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems.
The Availability Category considers controls that demonstrate the system is available for operation and use as committed or agreed upon. Consider this criteria if your customers must demonstrate that their systems are available at all times. Availability does not set a minimum acceptable performance level but addresses whether systems include controls to support accessibility for operation, monitoring, and maintenance. Examples include sufficient data backups and disaster recovery plans.
The Confidentiality Category requires companies to demonstrate that data classified as confidential is protected. Confidentiality applies to various types of sensitive data such as personal information, trade secrets and intellectual property. Controls for Confidentiality include encryption and identity, along with access management. This category should be considered if you are storing sensitive information that is protected by Non-Disclosure Agreements (NDAs) or if your customers have requirements to delete data that is obsolete.
The Processing Integrity Category focuses on ensuring that a system process is complete, accurate, timely, and authorized. It addresses whether systems achieve their purpose and perform their intended functions in an unimpaired manner, free from error, delay, omission, and unauthorized or inadvertent manipulation. This category should be considered if your customers are executing critical operational tasks on your systems such as data or financial processing. Because of the number of systems used by an entity, Processing Integrity is usually addressed only at the system or functional level.
The Privacy Category aims to show that personal information is collected, used, retained, disclosed, and disposed of properly. Although similar to Confidentiality, Privacy refers specifically to Personally Identifiable Information (PII) that your organization collects from customers. It also verifies that appropriate parties have access to the information and what can be done with it. Controls for Privacy include privacy policies and consent management mechanisms. Consider this category if your customers are storing PII such as health records, payment card information, social security numbers, or birthdays.
We’ll answer all your questions and help you understand the cybersecurity practices for SOC 2 and all the bureaucratic fine print in your contract.
We’ll do a gap analysis to identify gaps in controls and procedures relevant to the Trust Services Criteria (TSC).
We’ll formulate a roadmap that charts the initiatives and timeline necessary to mature your processes and procedures.
Right Hand Technology Group is CompTIA Security Trustmark+™ certified and has been ranked as one of the top Managed Service Providers in the world. Our experienced staff of Cybersecurity Professionals and Security Engineers have been working with various industries on cybersecurity for more than 20 years.
The Certified Information Systems Security Professional is an information security certification with extremely high standards. Less than 132,000 people worldwide had this certification at the end of 2018.
It has also been formally approved by the DOD and is globally recognized in the field of IT security.
It covers the following topics:
Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)
Security Assessment and Testing
Security Operations
Software Development Security
This a system engineer certification and tests the user’s knowledge on the following topics:
Windows
SQL Server
Exchange Server
SharePoint
System Center (SCCM)
Lync
The A+ Certification demonstrates that the computer technician has the skill set needed to customize, install, maintain, and operate PCs.
In addition to these certifications, Right Hand also has strategic partnerships with some of the biggest names in the industry like Microsoft, Dell, Citrix, and Fortinet.
What could be more assuring than having these industry giants on your side?
As the name suggests, this certification is for Network Engineers. Everything from the installation and maintenance to troubleshooting of networks including the understanding of all related technologies is a part of the course.
This certification shows that the technician who has passed the Microsoft exam is capable of managing, migrating, deploying, planning, and assessing the technology, security, and compliance needs associated with Microsoft Office 365.
The CompTIA Security Plus SY0-501 course provides certifications in the following topics:
Threats
Vulnerabilities
Attacks
System Security
Network Infrastructure
Access Control
Cryptography
Risk Management
Organizational Security