A Breakdown of the Latest SOC 2 Guidance Revisions (October 2022)
While in school, did you ever have a professor that would sneakily test on obscure materials? You could read the textbooks, but that material you assumed would be the bulk of an exam wasn’t mentioned—instead, your test questions were focused on the footnotes or some other material you weren’t aware of or clearly alerted to review beforehand.
If so, we agree that must’ve been insanely frustrating to not have proper guidance before a major evaluation, leaving you with a bad grade and no explanation as to why or how you can improve your work.
The good news is that you’re out of school, and for those undergoing SOC 2 examinations, there’s an abundance of guidance provided by the AICPA. This information is meant to assist service organizations and their auditors in preparing for, executing, and reporting on a SOC 2 examination—the latest version was released in October 2022.
As SOC auditors for over two decades now, we’re incredibly seasoned in performing SOC 2 examinations, but that doesn’t mean we don’t appreciate the additional help, just like you would when trying to reach your compliance goals. In this article, we’re going to break down the latest AICPA guidance so that you can further simplify your SOC 2 process.
6 Key Changes to the SOC 2 Guide
For those completely unfamiliar, the SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (SOC 2 Guide) is used by practitioners providing SOC 2 services and examinations and can serve as a reference for organizations that issue SOC 2 reports.
Among the many small revisions to the latest SOC 2 guide meant to assist practitioners in planning, executing, and reporting for a SOC 2, these key changes could have a more significant impact on how you and your auditor prepare for or perform a SOC 2 examination:
|
Key Change |
Guidance is Provided On: |
|---|---|
|
Information Provided by the Entity (IPE) |
(As such, your auditor may make additional inquiries into how a piece of evidence was generated or perform additional procedures to confirm that the evidence provided was not modified after it was generated.) |
|
|
|
Review Controls |
You should expect additional inquiries from your auditor regarding:
|
|
Controls That Operated Prior To The Period or |
How your auditor should:
|
|
Objectives, |
|
|
IT Services |
|
8 Key Changes to SOC 2 Description Criteria and Trust Services Criteria
In addition to the updated SOC 2 Guide, the AICPA also released revised guidance on the Description Criteria and Trust Services Criteria. Though these haven’t materially changed, their points of focus have been updated with information that:
- Organizations should consider when designing controls; and
- Auditors should consider in their evaluation of the controls over SOC 2 criteria.
Some of these key updates were to the following areas:
|
|
Details |
|---|---|
|
Privacy |
|
|
Incident Disclosures |
|
|
Risk Disclosures and Assessments |
Regarding the risk assessment process and specific risks that threaten the achievement of your service commitments and system requirements, you must also disclose additional details, including:
|
|
Data Management |
Particularly when related to confidentiality (e.g., data storage, backup, retention), new guidance suggests that you should clearly identify personal information within a system and restrict access based on this identification and classification of sensitive information. |
|
Information |
Pertaining to the identification, documentation, and maintenance records of system components including infrastructure, software, and other information assets, the added points of focus also expounded on:
|
|
New Architecture |
Added guidance on how to identify and assess the security of new system architecture before its implementation into your system environment. |
|
Change Management |
If Availability is In-Scope: Consider testing system resiliency within your change management procedures. If Privacy is In-Scope: Consider the privacy requirements in the design of your system and the collection and processing of personal information should be limited to only what is necessary. |
|
Assessing Vendor and Business Partner Risks |
Due to increased risk exposure relating to vendors and third parties, new guidance provides details on identifying vulnerabilities related to your third parties, including that of third-party access to the in-scope systems and how you should reassess relationships with vendors and third parties periodically. |
Moving Forward with Your Next SOC 2 Examination
While this breakdown doesn’t include all the AICPA updates to the SOC 2 Guide, Description Criteria, and Trust Services Criteria, these highlights presented can point you in the right direction to more thoroughly prepare for your next SOC 2 examination process. This isn’t like a sneaky college professor sourcing his exam questions from obscure materials—this information is intended to and will help you more easily achieve compliance through an understanding of the impacts these changes may have on your service commitments and system requirements.
For further details on all the revisions made to the SOC 2 guidance, AICPA members can procure the full and updated SOC 2 guide, Description Criteria, and Trust Services Criteria documents. The AICPA has also provided red-lined versions of the Trust Services Criteria and Description Criteria that each highlight the revisions.
Schellman also features additional resources that can assist in deepening your understanding of SOC 2, including our own guide to shaping an examination to your needs:
About Vinnie Minosky
Vinnie Minosky is a Manager with Schellman based in Columbus, OH, focusing primarily on SOC examinations. Vinnie has been with the firm for three years and prior to joining Schellman, he worked as a Senior IT Assurance Auditor at a large public accounting firm in Columbus, performing financial audit support and SOC audits across various industries. He has over six years of audit experience and maintains multiple certifications including: CISSP, CISA, and ISO 27001 Lead Auditor.