SOC for Cybersecurity

General

Press release: Risklane announces strategic partnership with TÜV Nederland

15 Jul 21 / 0 comments

Gavias Blockbuider SOC CYBER

The process of identifying, assessing, and managing risks is a critical component of the internal control system. Conducting a cybersecurity risk analysis ensures that risks are identified in a timely manner. Cybersecurity objectives must be defined before management can identify potential events affecting their achievement.

Identified risks are periodically assessed, in relation to cybersecurity objectives, to implement appropriate measures to monitor and manage risks. Risk mitigation plans are prepared based on the identified risks and risk action plan.

Data breaches are the order of the day. This often implies that confidential and sensitive information ends up with unauthorized individuals. This can happen through hacking, for example, because security patches are not updated in time, but also due to human errors.

By implementing a sound system for dealing with cybersecurity risks, the chance of data leaks is minimized. The framework also ensures that if an incident occurs, it is dealt with in a timely and structured manner.

Organizations are increasingly outsourcing business processes. While the user organization is ultimately responsible for preparing a diligent risk management framework, cybersecurity risks often reside with the organizations that provide outsourcing services.

By providing clients with a SOC for Cybersecurity statement, trust and transparency are provided to clients that cybersecurity risks are identified and handled appropriately. The assurance statement provides insight into the actual performance of the cybersecurity framework.

The key differences explained

SOC for Cybersecurity vs SOC 2

1. Description criteria and scope

Both the SOC for Cybersecurity and the SOC 2 standard have requirements for the content of the framework. SOC 2 focuses primarily on a framework for security, based on the COSO framework and security-related controls, as outlined in the Trust Services Criteria. SOC for Cybersecurity also has criteria for the description of a cybersecurity framework. The controls that are set up on the basis of risk assessments often arise from existing frameworks and procedures.

2. Indented users and purpose

SOC 2 is specifically aimed at a limited group of users: the user organization, independent auditors, and practitioners and regulators who have sufficient knowledge and understanding. The SOC for Cybersecurity report is intended for a broach range of users, similar to a SOC 3 reporting. Like SOC 3, the report does not consist of detailed control descriptions. A detailed cybersecurity framework is however included to provide insight into the used methodology and associated implemented processes.

Categories of description criteria

Preparing the Cybersecurity Risk Management Program

Issued by the AICPA, the SOC for Cybersecurity requires the implementation and maintenance of a cybersecurity risk management program. This program gives the user insight into how risks are managed and which IT components are used. The way in which this program is implemented is in principle form-free, but all Description Criteria must be part of the description. In addition, no relevant parts may be left behind that could have an impact on the choices of users.

1. Reporting sections

The SOC for Cybersecurity report consists of three main sections. Section one is the Assertion of the Management of the organization. In section 2 the Independent Accountant’s Report is included, which includes a statement on the operating effectiveness of the cybersecurity program. The actual cybersecurity risk management program is outlined in section three, which includes a detailed description of the program and associated processes and policies.

2. Description Criteria

The Description Criteria are intended to be implemented for the entire organization. However, it is possible to prepare a cybersecurity risk management program for a specific division or section of the organization. All Description Criteria must be considered when implementing the program. First, the nature of business and operation and information at risk are identified. Hereafter the cybersecurity risk management objectives, Governance structure, and the risk assessment process are outlined. Communication and information procedures are also included within the program, which is complemented by the monitoring and cybersecurity control process.