SOC 2 Compliance

Assurance for You, Confidence for Your Customers

Contact Us

What is a SOC 2 Report?

The System and Organization Control (SOC) 2 examination reports on one or any combination of the AICPA’s Trust Services Criteria including Security, Availability, Processing Integrity, Confidentiality, and Privacy. It demonstrates an organization’s commitment to its customer requirements and cybersecurity best practices.

Purpose and Use

The SOC 2 report is intended to meet the needs of a broad range of users that need detailed information and assurance about the controls at a service organization. The report can play an important role in oversight of the organization, vendor management programs, and internal corporate governance and risk management processes.

The report can be distributed to an organization’s stakeholders including user entities, CPAs providing services to such user entities, regulators, and business partners.

AICPA Trust Services Principles

Organizations have the ability to choose one or a combination of the five AICPA Trust Services Criteria depending upon their customer needs:

  1. Security – The system is protected against unauthorized physical and logical access.
  2. Availability – The system is available for operation and used as agreed upon.
  3. Processing Integrity – System processing is complete, accurate, timely and authorized.
  4. Confidentiality – Information designated as confidential is protected as agreed upon.
  5. Privacy  Personal information is collected, used, retained, disclosed, and/or destroyed in accordance with established standards.
Who Needs a SOC 2 Report?

Organizations that should consider a SOC 2 report include Cloud Service Providers (e.g., SaaS, IaaS, PaaS), enterprise systems housing third party data, IT systems management and data center colocation facilities. If you want to communicate your organization’s controls are properly designed, implemented and operating effectively, then the SOC 2 report may be right for you.

Benefits of a SOC 2 Report

Obtaining a SOC 2 report provides assurance to prospective and current clients that you have procedures and controls in place to provide reliable services, which will differentiate your organization during the sales process. Additional benefits include:

  • Increased trust and transparency with your internal and external stakeholders
  • Reduced cost of compliance and number of on-site audits
  • Helps ensure controls are appropriately designed and operating effectively to mitigate risks
  • Satisfaction of audit requirements

Types of SOC 2 Reports

Type 1 Report

The SOC 2 Type 1 Report (referred to as a point-in-time report), includes an opinion over the suitability of the design of controls at the service organization at a specific point in time. An initial type 1 report often serves as the starting point for subsequent type 2 reviews.

Type 2 Report

The SOC 2 Type 2 Report (referred to a period of time report) includes an opinion over the suitability of the design of controls at the service organization and the operating effectiveness of the controls throughout a specified period of time. This type of report is often issued annually.

Our Proven Process

At BARR, we are committed to guiding you through every stage of your SOC 2 audit from kickoff to final deliverable and everything in between.

Phase 1
Connect
  • About us
  • About you
  • Solutions
  • Proposal
Readiness Period (optional)
Readiness Meeting #1
  • Meet the team
  • Confirm expectations
  • System Demo
  • Confirm Scope
Readiness Meeting #2
  • Key processes walkthrough
  • Threat model
Readiness Meeting #3
  • Debrief
  • Finalize scope
  • Prioritize remediation
  • Review controls
Readiness Meeting #4
  • Remediate issues prior to audit start period
  • Confirm controls
Phase 2
3-12 Month Engagement Cycle
Plan
60-120 days before period end
  • System description
  • Confirm team
  • Request information
  • Schedule assessment
Celebrate & Optimize
30 days after report issuance
  • Debrief
  • Rate engagement
  • Improve security
  • Next steps
Assess
Half day to one week
  • Client interviews
  • Validate evidence
  • Conclude
Report
30-45 days after period end
  • Draft report
  • Quality review
  • Client sign off
  • Issue report
  • Promotional package

For first-time SOC 2 audited companies, BARR is really helpful in preparation.

BARR Advisory ran a very efficient process that used my time in a very efficient way. I would recommend their services to everybody looking for an efficient SOC 2 certification process.

We felt very confident during our SOC 2 audit, knowing that BARR had the right competence and would help us along the way.

Contact Us for a Free Consultation

We’re here to help you! Speak with a BARR specialist about your security and compliance needs.

Why BARR for SOC Reporting

  • BARR’s SOC clients report services lead to a 70% reduction in customer compliance questionnaires
  • SOC clients spend 75% less time spent on internal resources needed to pass audit
  • Nearly 100% client retention rate
  • Proven practical, adaptive approach that simplifies SOC reporting processes
  • Team members serve on task forces responsible for developing SOC reporting standards
  • Competitive, fixed rates to accommodate growing enterprises

Client Testimonials

Recent Blog Posts

Understand the Key Differences Between ISO 27001 and SOC 2 and Why You Might Need Both

| ISO27000, SOC Reporting | No Comments

With data risk on the rise, you may be questioning which security framework is best for your organization. Two compliance standards to consider are the International Organization for Standards (ISO)…

Company leader sits down to write the system description for their company's SOC 2 report.

Let’s Talk SOC 2 System Descriptions—What They Are and How to Write Them

| SOC Reporting | No Comments

Not sure what to include in your company’s SOC 2 report system description? You’re not alone. Some of the most common questions we get from our clients are related to…

How Long Are SOC Reporting Periods? Here’s What to Expect

| SOC Reporting | No Comments

Today, companies face an unprecedented amount of security challenges, which is why the need for a System and Organization Controls (SOC) report is more important than ever. A SOC report…

Bitcoin

Digital Meets Physical: Crypto ATMs and Best Practices for Operators

| Data Privacy, Risk Management, Security, SOC Reporting, Vulnerability Management | No Comments

BARR Advisory recently partnered with Bitcoin ATM vendor Bitaccess to complete SOC 1 and SOC 2 audits. Bitaccess has more than 3,800 Bitcoin Teller Machines (BTMs) around the world, serving…

Contact Us for a Free Consultation

We’re here to help you! Speak with a BARR specialist about your security and compliance needs.

Contact Us for a Free Consultation

We’re here to help you! Speak with a BARR specialist about your security and compliance needs.