SOC 2

About

Precision in Compliance, Assurance in Security

SOC 2 serves as a benchmark for data security and privacy controls. It helps organizations protect their data, gain the trust of customers, manage risks effectively, and demonstrate their commitment to security and compliance in an increasingly interconnected and data-driven world.

Two types of SOC reports

• Type I: Test of Control Design Effectiveness (A period of time).
• Type II: Test of Control Operating Effectiveness (During a period of time of effectiveness)

Often, clients call Type I the policy documentation and Type II the testing phase. Although this is accurate, Type I is more than that, as it includes an assessment of the design and implementation of controls, in which additional audit artifacts are required outside of policies and procedures (e.g. Risk Assessment, Pen Testing, Sample of 1, etc.). Elevate helps you navigate these differences and determine what is the best approach to achieve compliance.

What We Do

• Readiness / Gap Assessment 
• Consider boundary definition 
• Consider which principles you would like to include, with security being the baseline to confidentiality, availability, and processing integrity being additional, to privacy being the most expensive 
• Supplemental services such as Penetration Tests, Vulnerability Scans, Policy and Procedure Development, and other remediation activities 
• Audit by External Assessor