3 ms·

SOC2 isn't really about security in a "cyber" sense, so it makes sense that you don't associate it with cybersecurity. You literally do not need a pen test to

SOC2 isn't really about security in a "cyber" sense, so it makes sense that you don't associate it with cybersecurity. You literally do not need a pen test to pass SOC2 Type 1, for example.

OrvalWintermute 4y ago
> SOC2 isn't really about security in a "cyber" sense SOC2 according to AICPA is, and this could be highly "cyber" if the organization self-asserts a number of cyber security controls. > Controls affect user entities > SAE No. 18, Attestation Standards: Clarification and Recodification, which includes AT-C section 105, Concepts Common to All Attestation Engagements, and AT-C section 205, Examination Engagements. AICPA Guide, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, 2017 Trust Services Criteria) > Description of service organization’s system. Written assertion by service organization management regarding the description of the service organization’s system and the suitability of the design and the operating effectiveness of the controls to provide reasonable assurance that the service organization’s service commitments and system requirements were achieved based on the applicable trust services criteria. Service auditor’s report that contains an opinion on about whether the description is presented in accordance with the description criteria and the controls stated in the description were suitably designed and operating effectively to provide reasonable assurance that the service organization’s service commitments and system requirements were achieved based on the applicable trust services criteria. In a type 2 report, a description of the service auditor’s tests of controls and the results of the tests from https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/cpas https://us.aicpa.org/interestareas/frc/assuranceadvisoryserv...
- TameAntelope 4y ago
  I'm just giving my perspective as someone who's gone through it recently. It was a lot more about setting up policies and practices than it was practical digital security. More about documents describing security plans than about specific implementations and checking that they work and are effective.

SOC2 isn't really about security in a "cyber" sense, so it makes sense that you don't associate it with cybersecurity. You literally do not need a pen test to pass SOC2 Type 1, for example.

OrvalWintermute 4y ago

> SOC2 isn't really about security in a "cyber" sense SOC2 according to AICPA is, and this could be highly "cyber" if the organization self-asserts a number of cyber security controls. > Controls affect user entities > SAE No. 18, Attestation Standards: Clarification and Recodification, which includes AT-C section 105, Concepts Common to All Attestation Engagements, and AT-C section 205, Examination Engagements. AICPA Guide, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, 2017 Trust Services Criteria) > Description of service organization’s system. Written assertion by service organization management regarding the description of the service organization’s system and the suitability of the design and the operating effectiveness of the controls to provide reasonable assurance that the service organization’s service commitments and system requirements were achieved based on the applicable trust services criteria. Service auditor’s report that contains an opinion on about whether the description is presented in accordance with the description criteria and the controls stated in the description were suitably designed and operating effectively to provide reasonable assurance that the service organization’s service commitments and system requirements were achieved based on the applicable trust services criteria. In a type 2 report, a description of the service auditor’s tests of controls and the results of the tests from https://us.aicpa.org/interestareas/frc/assuranceadvisoryservices/cpas https://us.aicpa.org/interestareas/frc/assuranceadvisoryserv...

TameAntelope 4y ago
I'm just giving my perspective as someone who's gone through it recently. It was a lot more about setting up policies and practices than it was practical digital security. More about documents describing security plans than about specific implementations and checking that they work and are effective.