Nucleus Networks: SOC 2 Journey

The Service Organization Control for Service Organizations (SOC 2) attestation is one of several data security regulations that has become important in recent years. It is designed to help organizations demonstrate and validate how they protect sensitive data. We are proud to announce that we have begun the process of aligning our business to the requirements of SOC 2. While our vCIO team has helped many clients achieve SOC 2 compliance and successful audits, Nucleus Networks has decided the time is right for us to meet this recognized standard. We have targeted our audit period to end on October 31, 2024. Once completed, we will be happy to present our SOC 2 Type II report to interested parties through our Trust Portal. In this blog post, we’ll explain why SOC 2 matters and its core elements.  

How does it Work?
 
SOC 2 is a framework developed by the American Institute of Certified Public Accountants (AICPA) for service organizations that encompasses numerous aspects of business management and operations using five Trust Services Criteria (TSC): Security, Confidentiality, Privacy, Availability and Data Processing Integrity. The resulting independent review by an accredited examiner provides organizations with a transparent overview of how a business operates and securely manages their data. 
 
Security: The core part of your audit is focused on looking at the effectiveness of the policies and procedures your organization uses to prevent and respond to security issues. It is designed to establish a company-wide security program and works as a blueprint for your organization's ongoing security strategy. Some of these requirements include basic policies and procedures that employees need to follow related to information security, security checks, onboarding and passwords. The security review requires your organization to identify and protect systems and tools that keep your services running like data protection, encryption, backups, software updates, monitoring etc. Security Awareness Training must also be provided. 
 
Privacy: Privacy addresses the secure collecting, storing, and handling of personal information, like name, address, email, Social Insurance Number, or other identification info, purchase history, criminal history, etc. The privacy criteria tests whether you effectively protect your customers’ personal information. 
 
Availability: This category requires that information and services are available for operation and use to meet the organization’s objectives. 
 
Confidentiality: Confidentiality addresses controls for identifying, protecting, and destroying information designated as confidential. Examples of this information may include business plans, financial or transaction details, legal documents, etc. 
 
Processing Integrity: This addresses processing errors and how long it takes to detect and fix them. It also makes sure that any system inputs and outputs are free from unauthorized manipulation. This criteria helps businesses make sure their services are delivered in an accurate, authorized, and timely manner. 

What are the SOC 2 Controls? 
 
While there are many controls associated with each of the five TSCs, here’s a list of the most common ones: 
 
Control Environment: Controls related to a commitment to integrity and ethical values.  
 
Communication and Information: Controls related to the internal and external use of reliable information to support the functioning of internal controls. 
 
Risk Assessment: Controls related to the identification and assessment of risk relating to objectives, including fraud. 
 
Monitoring Activities: Controls related to the performance of ongoing and separate evaluations to determine deficiencies of controls and communicate those to the correct responsible personnel. 
 
Control Activities: Controls related to the control activities that contribute to the mitigation of risks and establishment of policies and procedures. 
 
Logical and Physical Access Controls: Controls related to the implementation of logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet its objectives. 
 
System Operations: Controls related to the use of detection and monitoring procedures to identify changes to configurations that result in the introduction of new vulnerabilities and susceptibilities to newly discovered vulnerabilities. 
 
Change Management: Controls related to the authorization, design, development, testing, approval, and implementation of changes to infrastructure, data, software, and procedures to meet its objectives. 
 
Risk Mitigation: Controls that Identify, select, and develop risk mitigation activities for risks arising from potential business disruptions. 
 
What’s the Difference between SOC Type 1 and 2 Reports? 
 
The Type 1 report assesses your compliance at a single point in time. Typically, this involves checking to see that you’ve identified and documented the controls you have in place, as well as provide sufficient evidence that your controls are functional at that point in time. 
 
The Type 2 audit tests not only your compliance program but also the operating effectiveness of controls over time. Usually, a Type 2 audit assesses your compliance over a six to 12-month review period, with your first audit typically lasting up to six months. 
 
A SOC 2 audit report describes a service organization’s controls and whether they stand up to scrutiny. It’s issued by a CPA firm meant to be read, understood, and evaluated by other compliance and security professionals. It requires ongoing commitment to evolving best practices and standards related to data protection.  

Why Partner with a Managed Service Provider (MSP) with SOC 2 Attestation

Partnering with a SOC 2 Type II MSP provides businesses with assurance that their MSP is meeting the highest standards for data protection. This is especially crucial for industries with strict regulations, such as finance, healthcare, insurance, manufacturing and engineering where data security and compliance is vital. If your organization is considering SOC 2 and you require a MSP with accreditation, contact us to learn how we can help.