SOC 2 Cloud Compliance Guide

There are two types of SOC 2 audits: Type 1 and Type 2. A SOC 2 Type 1 audit evaluates an organization’s internal controls at a specific point in time (e.g., on March 1). A SOC 2 Type 2 audit evaluates and details an organization’s internal controls over a duration of time (e.g., between March 1 and December 31). 

SOC 2 vs SOC 1

SOC 1 differs from SOC 2 in scope. Whereas SOC 2 focuses on the five trust principles, SOC 1 assesses a cloud service provider’s internal controls that are relevant to financial reporting. As such, it’s ideal for companies that handle sensitive financial information. Payment processors, collection agencies, and benefits administrators are examples of organizations that are a good fit for SOC 1. 

Why is SOC 2 compliance important?

SOC 2 compliance is important because organizations must ensure they have the protocols and systems in place to keep customer information secure. Achieving SOC 2 compliance demonstrates to current and prospective customers and partners that the organization takes cloud security seriously. In fact, it’s not uncommon for client contracts to stipulate SOC 2 compliance. Also, SOC 2 reports are widely accepted and replace the need to undergo a custom cybersecurity audit each time a new customer onboards.

SOC 2 trust principles checklist

To achieve SOC 2 compliance, companies must comply with SOC 2 trust principles. However, only the security principle is mandatory — the others are optional. An organization can pick and choose from the optional principles to demonstrate an even greater commitment to protecting customer information. 

The trust service principles are: 

1. Security - risk-mitigating controls designed to protect information against unauthorized access, unauthorized disclosure, or damage throughout its lifecycle.  

2. Availability - controls intended to support and maintain system operational uptime so that information is sufficiently available to meet business objectives and service agreements. 

3. Processing integrity - controls designed to ensure data is processed predictably and free from errors for maximum accuracy and reliability. 

4. Confidentiality - controls designed to ensure sensitive information such as intellectual property and trade secrets are kept confidential throughout its lifecycle, from collection to disposal.  

5. Privacy - controls designed to ensure personally identifiable information (PII) captured by an organization is only accessible to appropriate parties.

SOC 2 audits

SOC 2 audits must be performed by a licensed CPA. It’s normal for the process to take months, although completing a SOC 2 readiness assessment to examine any gaps in controls or processes prior to the start of the audit can help speed the process. 

You can expect your audit team to generate an Information Request List (IRL) and narrow down which of the trust service criteria you’ll evaluate. You’ll submit evidence of your internal controls to the auditor, after which they’ll conduct a formal walkthrough of your environment. After that, the auditor will generate a SOC 2 report, which details the evaluation. You can learn more about this in SOC 2 Audits: Reporting & Certification in the Cloud.

SOC 2 compliance in the cloud

The five SOC 2 trust principles each have their own subcategories. Here are the subcategories that are relevant to the mandatory security criteria as it relates to compliance in cloud environments.

• CC2.0: Communication and Information - Addresses how organizations handle internal and external communication and information flows.

• CC5.0: Control Activities - Addresses how an organization’s control activities account for risk management and technology.

• CC6.0: Logical and Physical Access Controls - Addresses how an organization’s controls enable logical access to IT systems and credentials, regulate physical access to facilities, and contain security measures to detect and prevent unauthorized access.

• CC7.0: System Operations - Addresses how an organization’s controls monitor systems for potential anomalies, events, and configuration changes that may carry security risks, and define incident response protocols to contain, remediate, and communicate security incidents.

• CC8.0: Change Management - Addresses how organizations evaluate and determine necessary changes in infrastructure, data, software, and procedures, enabling them to securely make changes and prevent unauthorized changes.

How Snyk can help with SOC 2 compliance in the cloud

Cloud environments add a new dimension to an organization’s infrastructure and must be secured to keep customer information safe. Snyk uses a unified policy as code engine to help teams develop, deploy, and operate safely in the cloud. It leverages cloud security automation for best-in-class cloud compliance right out of the box.

SOC 2 FAQ