SOC 2 Compliance: Real Answers to Your Top Questions

Your boss:

“We need to get SOC 2 compliant.”

You:

With SOC 2 exploding in popularity, You’ve probably heard so much same-sounding marketing talk about it that it’s all starting to blur together in your mind. Relax. This article is a bit different. Take some deep breaths and keep reading. Team Trustero will avoid vagueness and confusion and help you know what you really need to know to get started successfully.

Why does my company need to be SOC 2 compliant?

What You’ve Likely Heard:

• “To close a big deal.”
• “To pass our audit”

The Real Answer:

You need SOC 2 compliance:

• To protect against risks that could wipe you out.
• To speed up your deals, by, for example, skipping the back-and-forth required to complete multiple security questionnaires.
• To get your story strong for all future scrutiny about privacy, security, confidentiality, and related issues.
• To close a deal and/or pass an audit – because those are good answers, too!

How Trustero Can Help: Trustero Compliance as a Service (CaaS) is built to ease and speed compliance. Stop having confused and stressful meetings about what you might have to do. Start turning the job into tasks you can assign and manage until the project is complete. The platform is specifically designed to help you sustain compliance, even as requirements and your business evolve. Continuous compliance makes future audits faster and easier, and enables continuous improvement of your business policies and processes.

How do I get SOC 2 compliant?

What You’ve Likely Heard: “Buy our compliance automation tool!” 

The Real Answer: 

You’ll need an auditor, and a champion to support you and keep you in control as things develop. You’ll also need tools to keep you organized and your information up to date.

The auditor. You’ll need a relationship with an auditor certified as a CPA by the AICPA and focused on information security audits. An experienced, reputable auditor will work with you to determine the specific steps you’ll need to take to prepare for and successfully complete a SOC 2 audit. Those steps include: 

• Establish the scope of your compliance effort. Do you need to deal with Expensify or employee cell phones for this audit?
• Describe your company and its business from a compliance perspective.
• Define the policies and processes that run and govern your business. This is a back-and-forth between your team’s best summaries and the auditor’s mandate to make your company the best version of itself.
• Work with your auditor to validate that evidence and create the final audit report that documents your compliance.
• Repeat at least annually.
  

The champion. Your business has some regular practices, but for SOC 2 it needs these canonized into policies and controls that will be like legal requirements for your team going forward. Knowing what’s going on is half the battle. For this you’ll want someone on your team who can help you figure out which way is up. Your journey should include corporate leadership as well as those responsible for Finance, HR, IT, Legal, and Security, both cyber and physical.

The tools. Until a few years ago, the only option was to write out ad hoc todo lists, fill spreadsheets with lists of controls, and upload evidence (often as a screenshot) in many layers of folders. Now purpose-built compliance automation platforms give you the right tool for the job, helping your whole team make a push together.

How Trustero Can Help: Trustero offers all three. Our Startup Assurance Package includes a respected auditor, an experienced customer success champion, a contemporary SaaS platform, and a complete audit report. Get the whole deal or pick the parts you need. Start from scratch or double down by taking your last audit and getting it into a service you can count on for all your future audits.

How long does it take to become SOC 2 compliant?

What You’ve Likely Heard:

“Our amazing solution can have you audit-ready in days!”

The Real Answer:

Many vendors offer tools that promise to get you “audit-ready” in weeks or days. More often than not, these promises are empty. Most new customers who sign on find they aren’t ready that fast. Also, the platform company may have a different definition of “audit-ready” than your actual auditor.

For example, many current tools promise automated evidence collection and tout scores of integrations with other tools and systems. But those claimed integrations deliver little real value, because the evidence those tools collect and present is often in a format auditors can’t or won’t use. 

Team Trustero has heard from auditors who have refused to work with companies using particular tools because the evidence those tools produce isn’t really evidence at all. Those tools merely deliver status indicators and do not “show their work” sufficiently to satisfy auditor requirements. And some produce results almost entirely incompatible with auditors’ processes and systems. 

Selecting the wrong tool can make your pursuit of SOC 2 compliance take longer, cost more, and make working with your auditor more challenging. Caveat emptor – “let the buyer beware.”

Beyond tool selection, preparing your team and your company for a first SOC 2 audit can take weeks to months. The time required depends on variables ranging from how long it takes to find an auditor you can work with to how well your current policies and processes are documented, enforced, and aligned with relevant SOC Trust Service Criteria. You and your auditor can and should perform a detailed pre-audit assessment of your business and IT environment. This step can ease and speed follow-on processes, but will take some time as well.

How Trustero Can Help: Trustero CaaS has multiple features designed specifically to ease and speed your SOC 2 compliance journey. 

• Auditor-vetted templates for policies and controls get you started quickly and minimize back-and-forth between you and your auditor. 
• AI-powered evidence and testing recommendations get you the results and validations you need in half the time required with other tools. 
• Automated alignment of evidence with controls and pro forma SOC 2 reports ensure you’re collecting and presenting evidence that’s credible and auditor-ready.
• Trustero CaaS is available in combination with connections to certified, experienced auditors experienced with the platform. Those packages include a guaranteed successful SOC 2 audit and complete report.

Trustero CaaS provides clear detail about controls, related evidence and evidence suggestions.

How much does it cost to become SOC 2 compliant?

What You’ve Likely Heard:

“Our auditor(s) can get you SOC compliant for as little as $5,000!”

The Real Answer:

Yes, there are auditors who offer SOC 2 audits for as little as a few thousand dollars. But you should look beyond price and select an auditor with experience and expertise that aligns with your needs and goals. You also want an auditor more interested in a working relationship with your company than in just getting you through that audit.

In addition, your auditor is but one necessary cost associated with SOC 2 compliance. You may find your business needs to invest in additional technologies or services to meet SOC 2 requirements, and the costs associated with such investments can quickly exceed those of a completed audit report. 

Be prepared for cost estimates ranging from $10,000 to $50,000 or more, depending on your company’s specific needs and goals. Also remember that you must renew your compliance audit and report at least annually. Your goal isn’t just “one and done.” You need to achieve and sustain compliance, even as requirements change and your business evolves.

How Trustero Can Help: You need a solution that makes life easier for you and your team, and SOC 2 compliance faster, easier and less costly for your business, Trustero CaaS delivers features that do all of that and more.Here’s just a sample.

• Automated alignment of controls, evidence and policies.
• Collection, coordination and delivery of evidence in formats your auditor can use with minimal modification.
• Clear, plain-language descriptions of controls, evidence and policies and their interdependencies.
• Easy tracking and documentation of your compliance journey, including pro forma SOC 2 compliance reports.

What are the key things you need to understand about SOC 2 compliance?

• SOC 2 compliance is worth doing.
• SOC 2 compliance can be confusing.
• SOC 2 compliance can be labor-intensive.
• SOC 2 compliance is only one of multiple frameworks with which your business needs or will need to comply – think ISO 27001, the GDPR, the California Consumer Privacy Act (CCPA),…

How Trustero Can Help: We enable SOC 2 compliance that’s simple, fast, automated and complete. 

Trustero Compliance as a Service (CaaS) is a cloud-based, AI-powered compliance automation platform. It works with you and your trusted auditor to achieve and sustain compliance year after year, effectively, efficiently, and economically – and without expensive investments in hardware, software, or services. Trustero also offers solution packages that include a guaranteed successful SOC 2 audit and complete report by a certified, reputable auditor. 

For more on how to achieve and sustain SOC 2 compliance, check out our complimentary ebook, “SOC 2 Compliance: Why it Matters and How to Get There.” And click here to learn more about Trustero CaaS or to schedule a demo.