What is a SOC 2 Bridge Letter?

How do you assure your employees, stakeholders, and customers of your SaaS company that their information is private and secure between compliance audit review periods?

Provide them a SOC 2 Bridge Letter.

A SOC 2 bridge letter is issued after your company or organization's SOC 2 report audit period has ended. It bridges the gap between the end of your last SOC 2 report audit and when you're ready to conduct your next audit, which is why it's also referred to as a 'gap letter.'

Usually, SOC 2 reports cover a user entity for 6 months to a year, but if your company follows a calendar year, then your report’s validity may leave you uncovered.

Does a SOC 2 bridge letter provide any coverage? In its most simple form, the answer would be:  No.

Bridge letters aren’t meant to take the place of another SOC 2 report, but to provide coverage of your company and trustworthiness to your customers and clients.

What Does a SOC 2 Bridge Letter Look Like & What is Included?

What a SOC 2 bridge letter should include:

• Significant changes to any systems or controls since the audit

OR

• A statement that the organization or company is unaware of any material changes from the latest SOC 2 report to its expiration.

What a SOC 2 bridge letter should NOT Include:

Remember, a bridge letter is sent to cover the gap between SOC 2 audit reports. It isn’t meant to take the place of the actual audit, therefore it shouldn’t include specific details like

• Test procedures
• Test results
• System descriptions

Here's an example of a SOC 2 Bridge letter template Johanson Group provides to our clients:

Who Writes and Issues a SOC 2 Bridge Letter?

Management of the company that received the previous SOC 2 report completes and sends the SOC 2 Bridge Letter to its stakeholders (not the auditor).

The letter intends to assure all intended recipients that there have been no significant changes to your SaaS company's controls between audit renewal periods. If there have been material changes, the SOC 2 bridge letter is where you would explain changes to your controls — if any— and assure your customers or clients how they wouldn't affect the results of your SOC 2 report.

The CPA firm conducting the SOC 2 audit is not involved in the writing or disbursement of a SOC 2 bridge letter. Why?

The entire purpose of the SOC 2 bridge letter is to attest that client, stakeholder, and employee privacy and security are still in compliance. If something were to change with the company's security services after a SOC 2 is complete, the CPA firm that conducted the audit could not speak to the passing of any new changes after the audit expires.

Why are Bridge Letters Important?

As you can see, bridge letters are an essential part of your SOC 2 compliance program. The written assurance to your customers and stakeholders that you are still in compliance after your SOC 2 report helps bring confidence and peace of mind that their information is secure and private and trust service commitments and requirements are being met.

LEARN MORE: Why Saas Start-Ups Should Prioritize SOC 2 Compliance

As we have seen, SOC 2 bridge letters are critical to your SOC 2 compliance. They help you to demonstrate that your controls are appropriately designed and operating effectively and can be relied upon by all stakeholders.

We encourage all organizations who use IT services to consider applying for a SOC 2 report and getting the letter as soon as possible, if they haven’t already done so.Remember, a bridge letter is a temporary coverage for your trust services compliance. Schedule your subsequent SOC 2 audit examination today with Johanson Group, your trusted CPA for SaaS organizations.

‍

For many companies trying to achieve SOC 2 compliance, keeping up with both the work necessary to get their controls in place along with actually running their business can be quite the juggling act. Luckily, you have a Customer Success Manager (CSM) to help!

So, what exactly does your CSM do? Simply put, your CSM will be your primary point of contact and the main person managing your account throughout the audit process. They are there to help make the roadmap ahead clear,  answer questions as you begin your journey, and are then there to keep the audit engagements on track for the years ahead. In order to better understand, let’s touch on the core aspects of a CSM’s role when helping you:

Onboarding

First and foremost, from the moment you sign on to have your audit performed, your CSM is the person who will be scheduling and then holding a kickoff meeting to help set expectations and answer any initial questions you might have as you’re getting started. This meeting walks through the process from start to finish, as well as establishes what the regular communications between you and them will look like moving forward. After the kickoff meeting, they will provide any necessary documents/links to help make sure you have everything to coordinate the audit.

Answering Questions and Scheduling the Audit

Once you’ve gotten your feet wet and have an understanding of what the next steps are, your CSM will be regularly checking in with you to see how things are going as well as provide support for any questions you might have. As you’re going through setting things up, they’ll also be on hand to schedule your audit and coordinate with any readiness platforms you are utilizing to support your SOC 2 compliance.

Supporting the Audit Itself

Once you have the date(s) you want to use for your SOC 2 audit, your CSM will then hand you off to our Audit Associates so that the controls testing can begin. While the CSM will not be performing the audit themselves, they work closely with the Audit team and communicate closely so that the project continues moving forward and you get your report as quickly as possible. If there are any additional evidence pieces needed or clarifications necessary, your CSM will coordinate with the Audit team to make sure these outstanding items are settled.

Continuing and Building Our Partnership

You’ve done it!

You finally have your SOC 2 report in hand! With the audit now complete, your CSM will be one of the first people out the gate to congratulate you; not only that, but they’ll also set expectations as to when we’ll reach out regarding the next report to ensure you won’t have any gaps in your compliance. After a few months, your CSM will reach out to see what your plans for your next SOC 2 report are; in that, they’ll provide a quote as well as coordinate having the Statement of Work (SOW) signed to formalize the engagement. Once you’re signed on, they’re once again there to support you for the various SOC 2 reports to come!

Whether you’re going for your first SOC 2 report ever or you’re a seasoned compliance veteran, it’s important to us that you have every possible tool and aid at your disposal so that you can walk through each step of the audit process with complete confidence that you will succeed.

In all, your CSM is the person to help make this happen; there to help make sure you will come out the other side of this journey with a report that leaves you and your customers satisfied. Whenever you feel stuck, you need only shoot an email over or make a phone call, and your CSM will be there!

‍

‍

During a SOC 2 attestation, companies need to use specific criteria to evaluate their services.

All the things surrounding SOC 2 reports and attestation can seem a little overwhelming and complicated. We get it; that's why we've created this quick guide to SOC 2 attestation reports with simplified terms and definitions to help you understand the basics.

A Quick SOC 2 Refresh

You've landed on this article for SOC 2 attestation, so odds are you already know what a SOC 2 report is, but just in case, here's a quick refresh:

What does the S-O-C in 'SOC 2' mean?

• The ‘S-O-C’ stands for System and Organization Controls Number Two.
• SOC 2 is a set of standards developed by the American Institute of Certified Public Accountants (AICPA).
  • These standards help businesses evaluate their internal controls and ensure they meet industry best practices regarding information systems management and cyber security.
• Now, onto the basics of SOC 2 attestation reports.

What is a SOC 2 attestation?

A SOC 2 attestation is a third-party assessment of a service organization’s controls relevant to

• Security
• Availability
• Processing Integrity
• Confidentiality
• Privacy

Why do you need a SOC 2 Attestation?

The idea behind a SOC 2 attestation is that companies can demonstrate their commitment to data protection by having their systems reviewed independently. Customers can then make informed decisions about whether it's safe to store sensitive information in the cloud and avoid legal issues down the road.

“The reason for a SOC 2 attestation is that it helps companies and clients know that information held at the service organization is being kept private and secure.”

What does a SOC 2 attestation include?

To assure customers that you're keeping their data safe and secure, you need to show that your company has thought through all aspects of data protection.

Including:

• How do you store customer data?

• Who has access to customer data?

• What measures do you take to protect information against cyberattacks?

What is required During a SOC 2 attestation?

During a SOC 2 attestation, companies are required to use a specific set of criteria to evaluate their services.

These criteria are organized into five trust services categories:

1. Security (required)
2. Availability (optional)
3. Confidentiality (optional)
4. Processing Integrity (optional)
5. Privacy (optional)

You will also want to ensure that these controls are in place within your systems prior to your SOC 2 attestation with a CPA:

• Network Firewalls
• Two-factor authentication
• Intrusion detection
• Performance monitoring
• Disaster recovery and Incident response procedures
• Security breach management
• Quality assurance
• Process monitoring
• Data encryption
• Access controls (physical and logical)
• Change Management processes

How long does a SOC 2 attestation take?

A SOC 2 Type I (point-in-time) attestation is typically completed in about 4-6 weeks. This may seem like a long time, but remember that it takes more time for complex organizations than for simple ones.

While these variables are essential in determining the duration of your audit, there are also other factors at play:

• If you're working with a new auditor and they don't have much experience on their side yet (for example, if you're their first client), then this will slow down the process somewhat as well. That's why we recommend choosing a CPA specializing in SOC 2 attestations like Johanson Group.

• Some companies may need additional support before providing all the necessary documentation required by SOC 2 auditors; this may add days or weeks to your timeline!

Need to add in SOC 2 Type II (period of time) details. Those audits are a minimum of 3 months the first time and 12 months for subsequent type II audits. Type I tests the design of control, whereas Type II tests both design of controls and their operating effectiveness over a period of time.

How much does a SOC 2 attestation cost?

The cost of a SOC 2 attestation depends on many factors, including:

• Size: Smaller organizations can often complete an audit at a lower cost than larger ones.

• Complexity: Suppose your company uses more complex controls and procedures than other companies. In that case, it will cost more to audit you than if it did not have as much complexity in its controls.

• Type of Service: What type of service is provided by the system being audited? For example, a mobile app for a SaaS start-up may be less expensive than an internal data protection solution for a SaaS healthcare provider due to its more straightforward design and architecture requirements.

• Type of audit (i.e., standard or enhanced): A standard assessment costs less than one that includes additional testing for application-specific vulnerabilities and threats (enhanced.)

The SOC 2 attestation process with Johanson Group

• The first step is to determine whether or not you are eligible for SOC 2 attestation services. If so, we will conduct an initial assessment and provide an estimate based on our findings.

• Once we have reviewed the scope of work and estimated costs, we can begin working with you to develop a detailed plan for implementing security controls into your existing environment. Our goal is always to achieve compliance as efficiently as possible while minimizing disruption to business operations.

In short, a SOC 2 report evaluates whether a service organization's systems and processes meet high standards for security and privacy.

It also assures on behalf of service providers so they can show customers how they use their information responsibly.

‍