#soc1soc2

The Cloud Security Alliance (CSA) Integrates Cloud Controls Matrix with SOC 2 Reports for Cloud Providers. The AICPA recently released an illustrative...

In order to clarify and eliminate redundancy within the requirements of the trust services criteria for privacy, changes have been made to the SOC 2 privacy principle guidelines.

After a review of the new SOC 2 guide, Reporting on Controls at a Service Organization, I noticed that the responsibilities of the service auditor, service organization and subservice organization all seem to have increased when it comes to how subservice organizations may be considered / treated under the new standard.

Cloud computing is a new way of delivering computing resources, not a new technology. Cloud computing providers give end users the ability to access applications via the internet. As Cloud computing is achieving increased popularity, security concerns have become paramount with the adoption of this new computing model. The effectiveness and efficiency of traditional protection mechanisms are being reconsidered as the characteristics of this innovative deployment model differ widely from those of traditional architectures.

A SOC 3 Report is a report on controls at a service organization addressing matters other than financial reporting. A SOC 3 report is prepared using the AICPA/Canadian Institute of Chartered Accountants (CICA) Trust Services Principles, Criteria, and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy.