Skip to content

Services

SOC 2 Audits

Your customers require it.

A new customer wants a SOC 2 report. Procurement needs it before the contract can move forward. A security review has reached the point where questionnaires are no longer enough. Suddenly, SOC 2 is on your plate.

A SOC 2 audit provides independent assurance over the controls protecting your customers' data and the systems that support your services. Security is always part of the examination; availability, processing integrity, confidentiality and privacy may also be included depending on your services and customer requirements.

TrustBridge makes sure you know what you need, what's in scope and what your team will be responsible for before the audit begins.

SOC 2 Type 1 or Type 2?

The right report depends on what your customers require and what they need the report to demonstrate.

  • Point in time

    Type 1

    Evaluates whether controls are suitably designed at a specific point in time.

  • Over a period

    Type 2

    Goes further, evaluating whether those controls operated effectively over a specified period.

Where you begin depends on the requirement, the maturity of your controls and what your customers need from the report. TrustBridge helps you determine the appropriate report type and scope before the examination begins, so you aren't taking on more than the requirement calls for—or discovering too late that the report doesn't address what your customer needs.

Know What Your Customers Expect. Audit Accordingly.

Every SOC 2 audit includes Security. The other Trust Services Criteria are included when they are relevant to your services, commitments and customer requirements.

  • Security – Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity's ability to meet its objectives.
  • Availability – Information and systems are available for operation and use to meet the entity's objectives.
  • Processing integrity – System processing is complete, valid, accurate, timely, and authorized to meet the entity's objectives.
  • Confidentiality – Information designated as confidential is protected to meet the entity's objectives.
  • Privacy – Personal information is collected, used, retained, disclosed, and disposed of to meet the entity's objectives.

The objective isn't to include every category simply because it's available. The scope should reflect the services you provide, the commitments you've made and the assurance your customers actually need.

Your Team Has a Business to Run

SOC 2 can involve people across security, IT, operations, HR and other areas of the organization. Their participation is necessary. Their attention shouldn't be consumed by an audit process that isn't well managed.

TrustBridge establishes responsibilities, timing and evidence requirements early, giving your team a clear view of what's needed and when. Requests stay connected to the controls being examined, questions are addressed as they arise and issues are identified while there is still time to deal with them.

That doesn't mean there won't be work to do. It means your team understands the work, why it's required and where the engagement stands.

Three colleagues talking over a tablet outside an office

From Requirement to Report

SOC 2 may have arrived as a customer request, but getting through the audit requires decisions about scope, criteria, evidence and timing. Those decisions are easier when you know what's ahead.

TrustBridge stays with you from the initial requirement through the examination and final report, bringing clarity to each stage without adding unnecessary complexity to the process.

The requirement may be SOC 2. The objective is to get your customer what they need and keep the business moving forward.

Talk to us about SOC 2 for your organization.

Request a Proposal