The AICPA defines a SOC 2 Type 1 report as - a report on the fairness of the presentation of management's description of the service organization's system and the suitability of the design of the controls to achieve the related control objectives included in the description as of a specified date.

To translate that to layman's terms - Is the company set up for success with its current controls and does the system description accurately reflect the company’s operations?

The AICPA defines a SOC 2 Type 2 report as - a report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives included in the description throughout a specified period.

To translate that to layman's terms - Did the company do what it said it was going to do when it said they were going to do it and does the system description accurately reflect the company’s operations?

SOC 2 Type 1

The SOC 2 Type 1 audit looks at one day (point in time) and gives the opinion that everything is set up correctly. The auditor will look at the system description and the controls to make sure that they match the SOC 2 criteria. The auditor will also look at the evidence to verify that the control is in place.

A SOC 2 Type 1 report will give you the peace of mind that you have designed your controls appropriately to meet defined Trust Services Criteria.

SOC 2 Type 2

All the work that you did for SOC 2 Type 1 applies to Type 2. Now you just need to follow those policies and do what you said you were going to do and collect the evidence to prove it. You have moved from the setup mode to the maintenance mode. A Type 2 report is demonstrating that the controls you designed and implemented in Type 1 are now operating effectively over the period chosen for the Type 2 audit.

Usually, the minimum audit period for a SOC 2 Type 2 is 3 months. You should talk with your customers to see if this will meet their needs. You might find one that will only take a minimum of 6 months. If your customers just need a report, then we would suggest going with the shorter period so that you can get out in the marketplace with the report and start winning new customers.

How To Decide What You Need

At the end of the day, your customers are going to want a SOC 2 Type 2 report.

If you need something quick to keep sales conversations going or as an internal milestone then a SOC 2 Type 1 is a great starting point. We would also suggest doing a SOC 2 Type 1 first if you are not using a readiness platform and are trying to do it by yourself. This will make sure that you are set up for a successful SOC 2 Type 2. You would hate to find out after your SOC 2 Type 2 audit period ended that your controls didn’t match the SOC 2 criteria. The SOC 2 Type 1 provides that safety net for you to know you are on the right path.

Deciding to do a SOC 2 Type 1 will not slow you down in obtaining a SOC 2 Type 2. While the audit is being performed on your Type 1 you can start the audit period for Type 2. That way you will already be part way through the audit period by the time you receive the SOC 2 Type 1 report.

The additional cost for a SOC 2 Type 1 report is usually fairly small. Most CPA firms will give you a bundled cost for a Type 1 and a Type 2 that provide the two audits at a significantly lower price.

If none of those cases fit your needs, then we would suggest you go straight for Type 2.

A readiness platform will make sure that all of your controls match the SOC 2 criteria and that you are set up for success.

If your customers will only take a SOC 2 Type 2 and you need something to prove you are taking it seriously and are working on your SOC 2, you can also ask your auditors for an engagement letter to share with your potential customers to show that you are working on your SOC 2 Type 2. That will have enough weight with potential clients to keep sales conversations moving forward.

SOC 2 Compliance Audit Readiness

No matter which path you take, you will end up at the SOC 2 Type 2 report. There isn’t a wrong way to approach it. As you are making your choice, talk to your customers (if you can) and talk to your auditor about what is going on. Your auditor can walk you through both paths and help you make the best decision for your company.

You’re dealing with private data and information, so suffice it to say, yes, a self-audit is a great way to ensure your organization takes its responsibilities for security seriously.

After a SOC 2 compliance self-audit and remediation, your organization is ready for its SOC 2 compliance audit from an experienced and specialized CPA like Johanson Group.

‍

‍

Information security is a pressing concern for organizations.

Cyber threats are on the rise, and more personal information falls into the wrong hands every day.

That's why organizations with an ISMS (information security management system) rely on standards in a set of series called the ISO 27000 series published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Within the ISO 2700 series are the ISO 27001 and 27002.

This article will discuss some key differences between ISO 27001 and 27002 and how each standard helps protect an organization's data from cyber threats.

But before we go into the differences, it's important to note that the ISO 27000 series standards focus on information security. They do not include physical safety, personnel security, or software development requirements.

ISO/IEC 27001 and 27002, what's the difference?

While seemingly similar, the two are just as different. If combined into one singular standard, the compliance criteria would be too complicated to implement and use practically.

To keep it simple, ISO 27001 is a recognized standard for an organization's ISMS. Think of it as a checklist of everything you must complete to receive compliance certification.

ISO 27002 references cyber security, privacy protection, information security, and risk assessment rules.

So, the key differences between the two are:

• Details:  ISO 27001 is broad regarding ISMS implementation controls and rules, while ISO 27002 offers detailed recommendations for compliance criteria.

• Applicability: Every ISMS organization and business isn't the same; therefore, following ALL of the recommendations listed in ISO 27002 wouldn't be realistic or needed. ISO 27001 requires organizations must undergo a risk assessment to identify risks but doesn't specify which ones. That is where ISO 27002 comes in handy. Use it as a guide for compliance to prioritize potential risks for your organization.

• Certification: Your organization can only be certified in compliance with ISO 27001 standards. Becoming certified means your organization is fully compliant in your efforts to manage confidential data and information–both your employees and your customers.

Looking for ISO 27001 Compliance Certification? Start now.

What is the benefit of gaining ISO 27001 compliance certification?

ISO 27001 is considered the gold standard for information security management.

It helps organizations implement a system of internal controls to control and monitor their information security risks.

The goal of ISO 27001 is to ensure that an organization maintains a high level of protection for its customers, business partners, employees, and suppliers by implementing an effective ISMS (Information Security Management System).

Organizations can meet this goal by complying with the standards outlined in ISO 27001/27002:

• Risk assessment
• Asset classification and identification
• Control implementation and maintenance

While it's true that you can implement an effective information security program without certification, it's highly recommended to do so because most top-tier customers require certification before they'll consider doing business with you.

This requirement makes sense when you consider that any company possessing sensitive personal or financial data would want to know that their provider has taken all necessary precautions to safeguard this information against cyber attacks. A certificate of ISO 27001 compliance will help ensure this protection.

Examples of how ISO 27001 and ISO 2007 are different:

• The focus of the standards:

The focus of both standards is on information security management, but they take different approaches.

ISO 27001 focuses on information security management and is a generic standard, meaning that the criteria within ISO 27001 can apply to any organization regardless of its sector or industry.

ISO 27002 focuses on data security and is specific; it provides guidance for implementing specific controls within an organization's IT infrastructure (e.g., firewalls).

An organization must determine what type of system or system components will be covered by this standard. For example, a financial institution would focus on entirely different control standards to comply with than a healthcare organization would.

• Process vs. implementation requirements:

In addition to addressing different organizational needs based on sector and industry type, these standards also differ in process requirements versus implementation requirements—that is, how they handle each step required during your risk management program's lifecycle.

Both standards include sections dedicated solely to defining policies explicitly related to risk assessment (ISO/IEC 27000 - 4) and how to implement the suggested measures into daily operations, such as incident response plans (ISO 14701).

Why you need a CPA firm to help your organization with your ISO 27001 or ISO 27002

When managing ISO 27001 or ISO 27002, you need a CPA firm to help your organization with the following:

• A plan:

A solid plan aligned with your business goals and objectives will be essential to ensure success. You will also want to ensure that all key stakeholders are involved in developing this plan.

• Processes and procedures:

Once you have created your plan, it is crucial to define how you will implement it within your organization so everyone knows what's expected of them when carrying out their responsibilities as needed throughout each stage of the ISMS life cycle.

• Knowing the right tools to use for your specific industry and organization:

For example, if your organization is sharing sensitive data across different departments, you will probably need encryption technology like passwords and biometrics authentication systems (fingerprint readers). An experienced CPA in ISO 27001/27002 compliance can suggest the right tools to help you meet compliance criteria.

Information security is laudable. It needs to be done right to make sure that it is effective.

To recap: The difference between 27001 and 27002 is that they both focus on information security but differ in how they go about it.

ISO 27001 focuses more on the processes of an organization, while ISO 27002 focuses more on the products or services that an organization provides.

The best way to protect yourself from cyberattacks is by having a team of professionals who understand both standards to help implement them correctly for your business needs.

Ready to get ISO 27001 certified? Contact Johanson Group today to get started.

‍

What is a SOC 2 Bridge Letter?

How do you assure your employees, stakeholders, and customers of your SaaS company that their information is private and secure between compliance audit review periods?

Provide them a SOC 2 Bridge Letter.

A SOC 2 bridge letter is issued after your company or organization's SOC 2 report audit period has ended. It bridges the gap between the end of your last SOC 2 report audit and when you're ready to conduct your next audit, which is why it's also referred to as a 'gap letter.'

Usually, SOC 2 reports cover a user entity for 6 months to a year, but if your company follows a calendar year, then your report’s validity may leave you uncovered.

Does a SOC 2 bridge letter provide any coverage? In its most simple form, the answer would be:  No.

Bridge letters aren’t meant to take the place of another SOC 2 report, but to provide coverage of your company and trustworthiness to your customers and clients.

What Does a SOC 2 Bridge Letter Look Like & What is Included?

What a SOC 2 bridge letter should include:

• Significant changes to any systems or controls since the audit

OR

• A statement that the organization or company is unaware of any material changes from the latest SOC 2 report to its expiration.

What a SOC 2 bridge letter should NOT Include:

Remember, a bridge letter is sent to cover the gap between SOC 2 audit reports. It isn’t meant to take the place of the actual audit, therefore it shouldn’t include specific details like

• Test procedures
• Test results
• System descriptions

Here's an example of a SOC 2 Bridge letter template Johanson Group provides to our clients:

Who Writes and Issues a SOC 2 Bridge Letter?

Management of the company that received the previous SOC 2 report completes and sends the SOC 2 Bridge Letter to its stakeholders (not the auditor).

The letter intends to assure all intended recipients that there have been no significant changes to your SaaS company's controls between audit renewal periods. If there have been material changes, the SOC 2 bridge letter is where you would explain changes to your controls — if any— and assure your customers or clients how they wouldn't affect the results of your SOC 2 report.

The CPA firm conducting the SOC 2 audit is not involved in the writing or disbursement of a SOC 2 bridge letter. Why?

The entire purpose of the SOC 2 bridge letter is to attest that client, stakeholder, and employee privacy and security are still in compliance. If something were to change with the company's security services after a SOC 2 is complete, the CPA firm that conducted the audit could not speak to the passing of any new changes after the audit expires.

Why are Bridge Letters Important?

As you can see, bridge letters are an essential part of your SOC 2 compliance program. The written assurance to your customers and stakeholders that you are still in compliance after your SOC 2 report helps bring confidence and peace of mind that their information is secure and private and trust service commitments and requirements are being met.

LEARN MORE: Why Saas Start-Ups Should Prioritize SOC 2 Compliance

As we have seen, SOC 2 bridge letters are critical to your SOC 2 compliance. They help you to demonstrate that your controls are appropriately designed and operating effectively and can be relied upon by all stakeholders.

We encourage all organizations who use IT services to consider applying for a SOC 2 report and getting the letter as soon as possible, if they haven’t already done so.Remember, a bridge letter is a temporary coverage for your trust services compliance. Schedule your subsequent SOC 2 audit examination today with Johanson Group, your trusted CPA for SaaS organizations.

‍