SOC (System and Organization Controls) assessments are the international reference standard for service providers to demonstrate to their clients the effectiveness of their internal controls. Internet Security Auditors supports the preparation, the design of controls and the coordination with certified auditors.
SOC (System and Organization Controls) reports are third-party assessments designed to give clients and users of an organization's services independent assurance about the effectiveness of its internal controls. They are the most in-demand standard internationally among technology companies, cloud providers, fintechs and any organization that provides services that affect its clients' information systems.
There are three main types, each oriented to a different use and audience:
SOC 1 (based on SSAE 18 in the US or ISAE 3402 internationally) assesses the internal controls of a service organization that are relevant to the financial reporting controls of its user clients. It is mandatory for payroll processors, fund administrators, loan service providers and any organization that provides services that affect its clients' financial statements.
There are two subtypes: Type I (design of controls at a specific date) and Type II (design and operating effectiveness over a minimum period of six months).
SOC 2 assesses the controls of a service organization that are relevant to the AICPA Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. It is the most in-demand report among SaaS companies, cloud providers and digital infrastructures that need to demonstrate to their enterprise clients that their data is protected.
SOC 3 is a public, summarized version of SOC 2 designed for general distribution. It does not contain the technical details of SOC 2, but it provides a seal of trust that organizations can publish on their website or freely share with any interested party.
Internet Security Auditors supports service providers throughout the entire process prior to the formal audit: scope analysis and selection of applicable Trust Services Criteria, assessment of the current state of controls, design and implementation of the required controls, and audit preparation with a certified CPA firm. We also coordinate the relationship with the auditors and support the response to findings during the process.
Selection of applicable Trust Services Criteria, definition of the system in scope and determination of the report type (Type I or Type II).
Assessment of the current state of controls through interviews, document review and technical testing. Gap report with prioritization.
Definition of the necessary controls, assignment of owners, required evidence and implementation schedule.
During the observation period (minimum 6 months), continuous support in the operation of controls and the generation of evidence.
Coordination of the formal audit with a CPA firm. Response to requests and support until the SOC report is issued.
Scope of service
Scope analysis
Determination of the report scope, selection of Trust Services Criteria and design criteria for the control system.
Readiness Assessment
Assessment of the current state of controls against the applicable SOC criteria. Gap identification and remediation plan.
Control design
Definition and implementation of the controls necessary to meet the selected Trust Services Criteria.
Audit coordination
Support during the audit process with a certified CPA firm. Response to evidence requests and findings.
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental to strengthening our information security management system.
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance our cybersecurity maturity more quickly.
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner for the implementation of the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.
As CISO at Intaremit S.A., we place the highest importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company wants to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
At Grupo Arbulu, we have worked closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
As the CEO of Beruby, we worked with Internet Security Auditors when we urgently needed to carry out a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.
FAQ
SOC (System and Organization Controls) reports are third-party assessments designed to give clients and users of an organization's services independent assurance about the effectiveness of its internal controls.
SOC 2 Type I assesses whether controls have been appropriately designed at a specific date. SOC 2 Type II assesses whether controls have operated effectively over a period of time (usually 6 or 12 months). It is the report with the highest market value.
SOC 3 is a public, summarized version of SOC 2 designed for general distribution. It does not contain the technical details of SOC 2, but it provides a seal of trust that organizations can publish on their website or freely share with any interested party.
It is mandatory for payroll processors, fund administrators, loan service providers and any organization that provides services that affect its clients' financial statements.
The entire process prior to the formal audit: scope analysis and selection of applicable Trust Services Criteria, assessment of the current state of controls, design and implementation of the required controls, and audit preparation with a certified CPA firm. We also coordinate the relationship with the auditors and support the response to findings during the process.
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)
