A New Form of Assurance for the Ever Increasing Cyber Threats
Cybersecurity breaches across the country and around the world have heightened the awareness and attention of business executives, financial investors, boards of directors and the general public. With the number of breaches on the rise many experts are saying it’s a matter of when, not if, a breach will occur at any organization.
Although no one form of control can guarantee 100 percent security, a well-defined and implemented cybersecurity risk management framework will substantially reduce the likelihood of a breach.
With the implementation of the System and Organization Control (SOC) Report for Cybersecurity, the AICPA recognized the need to help organizations report on the effectiveness of their internal controls designed to prevent, detect, and respond to cybersecurity threats. Their objective is to provide a mechanism for providing corporate directors, senior management, and other constituents of organizations information on an organization’s cybersecurity program through the use of a common reporting framework of criteria designed specifically for evaluating cybersecurity risk.
The new SOC for Cybersecurity is designed to be a reporting mechanism for any organization, not just service organizations (i.e. organization that provide services to other organizations), which is how all other SOC reporting options are currently designed by the AICPA (SOC 1, 2, and 3 examinations). This reporting option was constructed with the mindset to provide a consistent reporting mechanism for any company looking for assurance over its cybersecurity controls.
Differences Between the SOC for Cybersecurity and the AICPA’s SOC 2 Examination Option - A Supplement, Not a Replacement
This new SOC report supplements the AIPCA’s SOC 2 reports on an organization’s controls designed to meet the Trust Services Framework, which currently does not include criteria for an organization to report on its controls specifically designed for cybersecurity risk.
With the increased scrutiny and evaluation of third and fourth-party service provider risk as part of comprehensive vendor management programs mandated by various regulators, the SOC 2 was considered inadequate in many ways with respect to addressing cybersecurity controls. The new SOC for Cybersecurity will help organizations bridge that gap.
Other noteworthy differences between the SOC for Cybersecurity and SOC 2 reports:
- The SOC for Cybersecurity is not restricted to service organizations and can be a reporting mechanism for any company’s cybersecurity framework. The SOC 2 is designed to report on controls over a service organization’s security, availability, processing integrity, confidentiality
- SOC 2 reports can be issued under two types, one of which includes an evaluation of the design and operation of controls over a period of time, thus providing greater assurance to users of the report that the controls are in place and operating within a service organization’s control environment. The SOC for Cybersecurity report does not include information on control design and operating effectiveness over a period of time, potentially providing less assurance that the controls for the entity’s cybersecurity program are indeed in place and operational on a continuing basis.
- Many organizations use third-party service providers to operate various aspects of their business, commonly resulting in reliance on those subservice providers to have controls of their own. SOC 2 reports enable a service organization to identify the controls they expect their third-party providers to have implemented and allows them to carve-out those control responsibilities from their control environment. However, the SOC for Cybersecurity does not offer an option to delegate any related control responsibilities to third-parties. Instead organizations are responsible for having all controls required to meet the cybersecurity framework requirements outlined by the AICPA.
What SOC Report Should You Consider?
Regardless if you are a user of reports or a service provider with the objective of providing your customers with some degree of assurance, chances are no single SOC report will meet all the needs of your organization.
There are several considerations that may make one report more applicable than another, however increasing demands for greater clarity and reassurance may mean more than one report is required.
The broader needs of most user entities will largely be covered by a SOC 2 examination, including the relevant scope of services and trust service principles that relate to its commitments and requirements to customers. That said, the increased attention and focus on cybersecurity may still require completion of a separate SOC for Cybersecurity.
As seen within the new regulation over cybersecurity issued by New York State’s Department of Financial Regulators, regulators are putting increased pressure on their constituents and adding requirements for vendor management programs to be more comprehensive, specifically to include due diligence measures that cover cybersecurity.
And to provide the necessary assurance being sought by an organization’s leadership and investors, the SOC for Cybersecurity provides an opportunity to answer the questions being asked by so many.
If in doubt, or to learn more about SOC reporting options for your company, contact our dedicated team of professionals that focus and provide SOC services on a national basis. Click here or call Dave Hansen, Principal, at 585.360.1481 to connect.