SOC for Cybersecurity Compliance

With high-profile attacks on the rise, the American Institute of Certified Public Accountants (AICPA) issued the SOC for Cybersecurity Reporting Framework. Using it, organizations can communicate pertinent information regarding their cybersecurity risk management efforts and educate stakeholders about the systems, processes, and controls they have in place to detect, prevent, and respond to breaches.

The AICPA determined that three separate types of reports were needed to address the information security reporting needs of organizations.

• Entity — Provides transparency to key elements of the entity’s cybersecurity risk management program.
• Service provider — In addition to entity-level benefits, provides sufficient, detailed information to address the user vendor risk management needs.
• Supply chain — In addition to entity-level benefits, provides sufficient, detailed information to address the user’s supply chain risk management tools.

• Management’s description — The description of the entity’s cybersecurity risk management program.
  This description is designed to provide information about how the entity identifies its information assets, the ways in which the entity manages the cybersecurity risks that threaten it, and the key security policies and processes implemented and operated to protect the entity’s information assets against those risks.
• Management’s assertion — Management provides the assertion regarding the presentation and effectiveness of the controls in place to achieve the cybersecurity criteria. The assertion addresses description criteria and control criteria.
• Practitioner’s opinion — A CPA’s opinion on the description of the entity’s cybersecurity risk-management program and the effectiveness of controls within that program to achieve the entity’s cybersecurity objectives.

Most cybersecurity experts agree that regardless of an organization’s size, a breach is not a matter of if, but when. Be proactive in ensuring your security controls and protecting your business interests with a SOC for Cybersecurity report. Benefits include:

• Increased transparency and assurance about cybersecurity program effectiveness
• Elevated stakeholder confidence in an organization’s preparedness
• Ability to promote internal operational efficiency

There are some key differences between SOC 2 reports and SOC for Cybersecurity reports with regard to scope, purpose and use, and controls. While a SOC 2 examination reports on the AICPA’s Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy) for a broad range of users, a SOC for Cybersecurity report is more specific in providing organizations with objective assurance that the appropriate systems, processes, and controls exist to manage a cyberattack. Objectives for a SOC for Cybersecurity report may include availability, confidentiality, integrity of data, and processing. Depending on your organization’s needs, a SOC for Cybersecurity report may be a valuable option even if your organization already has a SOC 2 Report.