SOC 2 reports covering periods ending on or after today must use the AICPA’s 2017 Trust Services Criteria, which replace the previous criteria and bring SOC 2 into line with the COSO 2013 internal control framework.
Key points
- Criteria are aligned with the 17 principles of the COSO 2013 framework.
- Security remains mandatory, with optional Availability, Processing Integrity, Confidentiality and Privacy categories.
- Points of focus provide guidance on how criteria can be met.
- More emphasis on risk assessment, including fraud risk and vendor risk.
- Type II reports continue to test operating effectiveness over a period.
SOC 2 is often required of SaaS and service providers by US clients. UK providers with SOC 2 reports should ensure their controls and descriptions are mapped to the new criteria before their next audit period ends.
Source: 2017 Trust Services Criteria (AICPA & CIMA)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
