Cloud computing is an efficient, conducive, and ubiquitous model for on-demand network access to a common pool of configurable computing resources, according to the National Institute of Standards and Technology (NIST) Special Publication 800-145. The goal of cloud computing is to achieve rapid provisioning with minimal service provider or management synergy. Cloud service providers typically deliver one of three types of services:
- Infrastructure as a Service (IaaS)
- Platform as a Service (PaaS)
- Software as a Service (SaaS)
SOC Reports and the Cloud
The cloud service (IaaS, PaaS, or SaaS) is built on an important factor: “trust”. Data breaches can and have cost millions in damages and as a result, customer trust in service providers’ security standards and practices is paramount. One of the best ways for a cloud service provider to obtain customers’ trusts is by having an attestation report performed by an independent third-party provider. It is even better when the attestation report is based on a trusted and established security framework.
The SOC 2 and SOC 3 reports are based on AT Section 101 attest standard, while the SOC 1 report is based on the SSAE 16 attest standard. The SOC 2 report provides a number of benefits for cloud service providers, including the following:
- the ability to communicate information about their services and suitability of design and operating effectiveness of their controls to prospective and existing customers
- the ability to mitigate the risks by reporting on controls around the five Trust Services Principles and Criteria: security, availability, processing integrity, confidentiality, or privacy
- the ability to select the Trust Services Principles to be reported on based on customer interests and needs
- the ability to cover all of the operational compliance requirements in the report as it pertains to the Trust Services Principles
For a cloud service provider, it is important to have the ability to communicate to customers that the best security practices are being used with their services and that those services meet the advertised availability numbers. Also, it is important that the systems are secure and that the data center integrity is confirmed. A SOC 2 report enables the cloud service provider to do just that. Moreover, from a SOC 1 perspective, the financial auditor of a cloud service provider’s customer may require the service provider to provide a SOC 1 report to gain comfort over internal control over financial reporting as part of the overall financial audit engagement.
Service Organization Controls (SOC) Reports
The American Institute of Certified Public Accountants (AICPA) developed the Service Organization Controls (SOC) reporting framework in response to a growing demand for attestation reports from service providers (or service organizations). Service provider customers (or user entities), potential customers, and regulators have an increased need to understand the internal controls of their service providers, for various reasons, depending on the services provided by the service organization. There are three types of SOC reports that will help understand those internal controls:
- SOC 1 - reporting on controls at service organization relevant to user entities’ internal control over financial reporting
- SOC 2 and SOC 3 – reporting on controls relevant to security, availability, confidentiality, processing integrity, and/or privacy Trust Services principles
Also, SOC reports can be a Type 1, which provides a report of controls in place and is designed to meet an objective or the Trust Services criteria; or a Type 2, which reports on not only controls in place but also provides evidence of the effectiveness of controls over a period of time.