SOC 2 is a technical audit that requires companies to establish and follow strict information security policies and procedures. A SOC 2 compliant service must follow these five “trust service principles” when managing customer data
System resources must be protected from unauthorized access or improper disclosure of information. To secure access, organizations can implement security tools such as two-factor authentication, web application firewalls (WAFs), Cloud VPNs and Software-Defined Perimeters (SDPs).
Accessibility of the system is determined by a contract or service level agreement (SLA). While this doesn’t apply to system functionality, it does require network performance to be monitored, including security incidents, site failover and other security-related issues that may affect availability.
To achieve processing integrity, the system must provide efficient data processing by delivering complete and valid information to the right place at the right time. By monitoring data and implementing quality assurance, organizations can begin to ensure processing integrity.
Confidential data must be hidden from unauthorized persons or organizations. Network and application firewalls along with access controls are essential for safeguarding sensitive data. Additionally, encryption can be used to protect confidentiality during transmission.
Organizations must meet privacy standards that address the collection, use, retention, disclosure, and disposal of personal information in accordance with the AICPA’s Generally Accepted Privacy Principles (GAPP).
For full details, please go to: https://www.perimeter81.com/regulatory-compliance/soc-2 or contact firstname.lastname@example.org