What is a SOC 1 bridge letter?

What is a SOC 1 bridge letter?

A bridge letter (also known as a gap letter) is an important document made available by the service organization (your vendor) to cover a period of time between the reporting period end date of the current SOC report and the release of a new SOC report.

How do you evaluate a SOC report?

When evaluating the SOC 1 report by a reputable firm, ensure that the service organization auditor evaluates materiality with respect to the fair presentation of management’s description of the service organization’s system, the suitability of the design of controls to achieve the related control objectives stated in …

What do SOC 2 reports look for?

The 5 possible covered criteria are: Privacy, Security, Confidentiality, Integrity and Availability. Service provider management is allowed to select which criteria they want included in the report, and once again you should make sure your specific concerns are addressed.

Who needs a SOC 2 report?

Who needs a SOC 2 report? If you are a service provider or a service organization which stores, processes or transmits any kind of information you may need to have one if you want to be competitive in the market exactly like the decision to have an ISO 27001 certifications.

Who can do a SOC 2 audit?

Who can perform a SOC 2 audit? A SOC 2 audit can only be performed by an auditor at a licensed CPA firm, specifically one that specializes in information security. SOC 2 audits are regulated by the AICPA.

Who needs a SOC 1 report?

If you are a large public organization using a third party service provider for services covering key financial reporting processes (such as revenue), it is imperative they offer a SOC 1 Type 2 report.

What does SOC 2 compliance mean?

SOC 2 is an auditing procedure that ensures your service providers securely manage your data to protect the interests of your organization and the privacy of its clients. For security-conscious businesses, SOC 2 compliance is a minimal requirement when considering a SaaS provider.

How long is a SOC 2 certification good for?

In general, service organizations will undergo annual SOC 2 (Service Organization Controls 2) audit reports. The SOC reports typically begin with a SOC Type 1 report in the first year followed by SOC Type 2 reports in subsequent years.

What are the SOC 2 controls?

SOC 2 compliance is based on specific criteria for managing customer data correctly, which consists of five Trust Services Categories: security, availability, processing integrity, confidentiality, and privacy.

What is a SOC 2 assessment?

In 2011, the American Institute of Certified Public Accountants (AICPA) created a series of Service Organization Control (SOC) assessments. A SOC 2 is an attestation report that provides controls assurance over a defined set of the service provider’s systems. …