soc 2 compliance checklist - controlcase

SOC 2 COMPLIANCE CHECKLIST SOC stands for System and Organization Controls and represents a set of compliance standards developed by the American Institute of CPAs (AICPA) – a network of over 400,000 professionals across the globe. SOC Audits aim to examine the policies, procedures, and internal controls of an organization. SOC 1 (Financial Controls) SOC 2 (IT Controls) SOC 3 (Publicly Shareable) SOC 2 applies to any organization wanting to effectively demonstrate to associated organizations controls associated with regard to Security, Availability, Confidentiality, Processing Integ- rity and Privacy or any combination of these as part of third-party relationships. It is also applicable to organizations that store its customer data in the cloud as well as Third-party service providers such as cloud storage, web hosting and software-as-a-service (SaaS) companies. SOC Compliance & Certification Reports on the processes and controls that influ- ence the organization’s internal control over financial reporting (ICFR). SOC 1 is also a standard assessment report required by user entities to comply with Sarbanes-Oxley Act (SOX). SOC 3 is similar to SOC 2 in terms of the audit criteria. The main difference is in the reporting - SOC 2 is tailored for sharing with specific organizations, whereas SOC 3 reports are more applicable for general audiences and therefore made publicly available. Designed for service organizations and reports on non-financial controls. Focuses on five key trust services criteria (formerly called trust services principles), or TSCs. SOC 2 outlines the standards that are necessary to keep sensitive data private and secure while it’s in transit or at rest. There are 3 types of SOC Audits and Reports

Upload: others

Post on 10-Jan-2022

6 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

SOC 2 COMPLIANCE CHECKLIST

SOC stands for System and Organization Controls and represents a set of compliance standards developed by the American Institute of CPAs (AICPA) – a network of over400,000 professionals across the globe. SOC Audits aim to examine the policies, procedures, and internal controls of an organization.

SOC 1 (Financial Controls)

SOC 2 (IT Controls) SOC 3 (Publicly Shareable)

SOC 2 applies to any organization wanting to effectively demonstrate to associated organiza-tions controls associated with regard to Security, Availability, Confidentiality, Processing Integ-rity and Privacy or any combination of these as part of third-party relationships. It is also applicable to organizations that store its customer data in the cloud as well as Third-party service providers such as cloud storage, web hosting and software-as-a-service (SaaS) compa-nies.

SOC Compliance & Certification Reports on the processes and controls that influ-ence the organization’s internal control over finan-cial reporting (ICFR). SOC 1 is also a standard assessment report required by user entities to comply with Sarbanes-Oxley Act (SOX).

SOC 3 is similar to SOC 2 in terms of the audit criteria. The main difference is in the reporting - SOC 2 is tailored for sharing with specific organiza-tions, whereas SOC 3 reports are more applicable for general audiences and therefore made publicly available.

Designed for service organizations and reports on non-financial controls. Focuses on five key trust services criteria (formerly called trust services principles), or TSCs. SOC 2 outlines the standards that are necessary to keep sensitive data private and secure while it’s in transit or at rest.

There are 3 types of SOC Audits and Reports

SOC 2 COMPLIANCE CHECKLIST

ABOUT CONTROLCASE:

For more information email [email protected]

Examples of what is addressed under the (5) SOC 2 Trust Service Criteria (TSCs):

Pen tests & vulnerability assessments

Application security measures

Firewalls

Intrusion detection systems (IDS)

Multi factor authentication tools

Access Control

Application & Network Security Measures

Computer Use Policies

Quality Assurance

Process Monitoring Sysstems

SECURITY

AVAILABILITY

PRIVACY

CONFIDENTIALITY

PROCESSING INTEGRITY

Performance & incident monitoring, response

Disaster response and recovery

Secure data backups

Notice and communication of objectives

Choice and consent

Collection

Use, retention, and disposal

Access

Disclosure and Notification

Quality

Monitoring and enforcement

Digital access controls

Physical access controls

Network & application firewalls

Crypotgraphic solutions

ControlCase is a global provider of certification, cyber security and continuous compliance services. Control-Case is committed to empowering organizations to develop and deploy strategic information security and compliance programs that are simplified, cost effective and comprehensive in both on-premise and cloud environments. ControlCase offers certifications and a broad spectrum of cyber security services that meet the needs of companies required to certify to PCI DSS, HITRUST, SOC 2 Type II, ISO 27001, PCI PIN, PCI P2PE, PCI TSP, PCI SSF, CSA STAR, HIPAA, GDPR, SWIFT and FedRAMP.

SOC Peripheral Components & SOC Tools

santantimo.etrasparenza.it · 19) soc. 20) soc. 21) soc. 22) soc. 23) soc. 24) soc. 25) soc. 26) soc. 27) soc. 28) soc. 29) soc. 30) soc. GI.TA.SI. SRL; STP SRL, DE CHIARA COSTRUZIONI

Report ID: HWSSR202 Hobart and William Smith Page No. 1 of ... · SOC - 224-Social Deviance SOC - 244-Religion in Amer Soc SOC - 251-Soc of the City SOC - 258-Social Problems

Hpu 2011 lec2 soc mediatica soc digital

Penetration Testing and PCI DSS 3 - ControlCase · PDF fileControlCase Annual Conference –Orlando, Florida 2015 Penetration Testing and PCI DSS 3.1 Erik Winkler, ControlCase

Sarbanes–Oxley Tools: Why do they fail? - ControlCase

PC Compliance in the Cloud - ControlCase · ControlCase Annual Conference –Orlando, Florida USA 2015 Compensating Controls Moderator Name: Pramod Deshmane, ControlCase Panelists

PCI DSS: Business as Usual - ControlCase · Why Business as Usual is part of 3.0 . ControlCase Annual Conference –Orlando, Florida USA 2015 - Interpretation has evolved over time

Automatically generated PDF from existing images.bcu.ac.in/uploads/2019/11/Sociology-Syllabus.pdf · 2020. 12. 7. · Paper Code soc 101 SOC soc 201 soc 251 soc 301 soc 302* SOC 303

7 The Best Supporting Actor - prodevmedia.com€¦ · The Best Supporting Actor is… ... Security Documentation: SOC, PenTest. ... –Proof of DR recovery exercise, checklist, timeline,

Advanced Certifications PA-DSS and P2PE - ControlCase · Advanced Certifications –PA-DSS and P2PE Erik Winkler, VP, ControlCase. ControlCase Annual Conference –Miami, Florida

SOC 100 professional tutor / SOC 100dotcom