Overview of Services Provided: You'll find a brief overview of the services provided by the company undergoing the SOC 2.

There are nine sections in Section 3, and this is usually the longest section of the report: You want to ensure that the scope of the SOC 2 report is relevant and applicable to your company, and the auditor assesses the technical environment of the application or service that you are planning on utilizing. It is possible this SaaS vendor earned a SOC 2 but not on the service or application that is relevant to your organization. You flip to Section 3 of the report, and you don't see AWS mentioned anywhere. You remember from conversations with them that they host their application on Amazon Web Services (AWS). For example, imagine receiving a SOC 2 report for a SaaS vendor that you are evaluating.

The description of the system outlines the actual scope of the SOC 2 examination covered. If you don't read any other section of the SOC 2 report, read section 3. This section does not contain technical details and is essentially your customers' management acknowledging that the information they provided was accurate and relevant. Section 2 of the SOC 2 report is management's assertion which is where the company undergoing the SOC 2 states that they prepared the system description (Section 3) and that the controls in that description were suitably designed as of a specific date and operating effectively over a period of time if a type 2 report. While section 1 gives you the overall status of the assessment, there aren't many details here beyond the opinion. An unqualified opinion means the auditor did not find any issues, every control tested was designed appropriately (Type 1) and operated effectively (Type 2). A qualified opinion is not the end of the world and is pretty standard. This issue could be something as simple as a new hire who didn't complete security awareness training or something more severe like a data store that is not encrypted at rest. A qualified opinion means the auditor found at least one issue during their evaluation. You should be aware of two common opinion types: qualified and unqualified. How do you know if the SOC 2 audit was 'passed' or completed successfully? Section 1 of the report contains the independent service auditor's opinion, which outlines whether or not the organization undergoing the SOC 2 assessment passed the assessment. Section 5 - Other information provided by management.Section 4 - Trust Services Criteria and Related Controls.

Section 1 - Independent Service Auditor's Report.In most SOC 2 reports, you will find four sections and an optional fifth section: This article will help demystify what to look for when receiving a SOC 2 report and where to find technical details and security configurations. SOC 2 reports help companies evaluate the security risks of their vendors and validate that your vendors have basic security practices in place to protect your sensitive information. When companies receive SOC 2 reports, it is challenging to uncover the critical details. Most security professionals have experienced a SOC 2 audit and understand the details of what goes into earning these coveted reports. SOC 2 has become the de facto standard for businesses in all industries to build trust and unlock sales. Immediately apply the skills and techniques learned in SANS courses, ranges, and summits

Drss up like a socss