SOC 2 Type 2

As organizations grow, they often start outsourcing services that were traditionally fulfilled internally. While outsourcing to third parties can certainly be beneficial by reducing workloads on teams, it can also be risky.

If an organization experiences a data breach because of a third-party service provider’s inability to ensure security, the organization is forced to pause business operations to recover and may lose revenue and customers as a result.

Organizations must ensure any third-party service providers or vendors accessing or handling their data meet specific security standards, minimizing the exposure of valuable corporate data.

What is SOC 2?

System and Organization Controls (SOC) 2 is an examination and report of an organization’s internal security controls developed to help companies determine whether third-party service providers—such as IT asset recovery and disposition vendors—can securely manage customer data.

SOC 2® was developed by the American Institute of Certified Public Accountants (AICPA), and the examination and auditing processes are split into two types of SOC 2 reports:

• A SOC 2 Type 1 report is a snapshot of a service organization’s internal controls at a single point in time.

• A SOC 2 Type 2 report examines a service organization’s internal controls to secure and protect customer data over a duration of time.

SOC 2 Type 2 is notably one of the most complex security examinations to endure due to its comprehensive and time-consuming process.

What is SOC 2 Type 2? 

A SOC 2 examination is “an examination of a service organization’s description of its system, the suitability of the design of its controls, and, in a Type 2 examination, the operating effectiveness of controls relevant to security, availability, processing integrity, confidentiality, or privacy.”

To conduct a SOC 2 Type 2 examination, organizations must select the Trust Services Criteria (TSCs) tailored to the controls they have in place and wish to examine.

Established by the AICPA, the TSCs consist of:

• Security: Focuses on protecting the assets and data of the service to ensure adherence to SOC 2 Type 2 standards against unauthorized use. Organizations can implement access controls to prevent malicious attacks or unauthorized removal of data, misuse of company software, unsanctioned alterations, or disclosure of company information.

• Availability: Focuses on the accessibility of data and systems used to meet business objectives. Assesses an organization’s maintenance by monitoring data, infrastructure, and software.

• Processing Integrity: Focuses on ensuring organizations deliver the correct data at the right time. System processing ​​should be complete, valid, accurate, authorized, and timely. This category also identifies if the established systems fulfill an organization’s set objectives and perform correctly—free from error, delay, or manipulation.

• Confidentiality: Focuses on restricting access and disclosing private data to ensure only specific people or organizations can view it. Confidential data may include sensitive business and financial information, customer data, trade secrets, or intellectual property. Confidentiality requirements may be outlined in laws, regulations, or contracts making commitments to customers or others.

• Privacy: Focuses on the system’s adherence to customers’ privacy policies and the Generally Accepted Privacy Principles (GAPP) from the AICPA. This category examines the methods used to collect, use, and retain personal information and the process for disclosure and disposal of data.

The Importance of Seeking Vendors with Clean SOC 2 Type 2 Reports

Remedying a corporate data breach generates high financial costs and hinders growth due to a loss in productivity. One of the simplest ways to mitigate those costs is to only work with third-party service providers willing to offer proof of a clean SOC 2 Type 2 report.

A clean SOC 2 Type 2 report assures your IT and business leaders that third-party service providers—like Mobile reCell—have adequate security controls in place around infrastructure, software, people, and processes for the protection and privacy of your company’s sensitive data.

The need for SOC 2 reporting is also being driven by newer regulations requiring data protection and privacy, such as General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Some government agencies and organizations require third-party service providers to obtain a clean SOC 2 audit report as part of their contract agreements.

For public companies, a clean SOC 1 report demonstrating internal controls around financial reporting and a clean SOC 2 report demonstrating the safe handling of valuable company data help to fulfill Sarbanes-Oxley requirements.

Mobile reCell has successfully completed a Systems and Organization Controls (SOC) 2® examination in accordance with American Institute of Certified Public Accountants (AICPA) standards for SOC for Service Organizations also known as SSAE 18. The independent third-party audit conducted by Prescient Assurance demonstrates to Mobile reCell’s current and future customers and partners that it manages its data with the highest standard of security and compliance.

You can rest assured your organization’s valuable corporate data remains safe and secure when you decide to work with us.

Mobile reCell’s clean SOC 2 Type 2 attestation report is available upon request. 

Learn how your organization can further benefit from partnering with Mobile reCell.

Follow us on social media!