Overview
  • As a SOC 2 consulting service provider, we advise our clients in SOC 2 attestation through a 6-phase implementation approach that includes understanding client business, setting business and security policy objectives, determining applicable SOC 2 trust principles, gap analysis, detail risk assessment, risk remediation support, policy documentation, end user training, monitoring, measurement, and audit, thereby leading to successful SOC 2 attestation.
  • With 20 years of security, governance risk and compliance practice, our methodology has been successfully implemented in business of all sizes and sectors, across the globe. Whether you are a startup in AI-ML-Data Science, SAAS, PAAS, IAAS provider, product developer or customer, or brick and mortar local or global business, we have implemented SOC 2 in fairly all industry sectors.
  • Security and compliance is everyone’s responsibility. We consider our methodology as most comprehensive as we involve every client key stakeholder in our SOC 2 implementation journey. We ensure ‘security by design’, and ‘privacy by design’ principles as part of client’s business DNA.
  • How fast can Coral get us SOC 2 certified? We follow an agile philosophy where phases of the project can run in parallel, resulting in achieving SOC 2 certification faster.
  • Contact us today to get started.

Kindly share your details for SOC2 requirements

Captcha
Service Organisation Control (SOC 2)
What are the SOC 2 Trust Principles
SOC 2 has the following 5 principles, listed below are the principles and their objectives.
  • Common Criteria Security: The system is protected, both logically and physically, against unauthorised access.
  • Availability: The system is available for operation and use as committed or agreed to.
  • Processing Integrity: System processing is complete, accurate, timely, and authorized.
  • Confidentiality: Information that is designated ‘confidential’ is protected as committed or agreed.
  • Privacy: Personal information is collected, used, retained, and disclosed in conformity with the commitments in the entity’s privacy notice and with the privacy principles put forth by the American Institute of Certified Public Accountants, and the Canadian Institute of Chartered Public Accountants (CICA).
Each of these principles has more detail risks/controls that need to be fulfilled.
SOC 2 Consulting Engagement Phases
Here is a brief overview of all the phases involved in implementing SOC 2 attestation.

PHASE I - Understanding Business, and Security Requirements and SOC 2 Report Objectives

  • Every client is unique with its business model, customers and business objectives.
  • The SOC 2 implementation journey starts with this phase where we determine and document the clients’ business requirements for SOC 2 including the applicable criteria.
  • SOC 2 Attestation requirement - Type 1 or Type 2

PHASE II -
Gap Analysis and Risk Assessment

  • As the name suggests, this phase is aimed at determining both the current controls and the ‘missing controls’.
  • In addition this phase involves determining information and its lifecycle, with its assets that store, process and/or transmit the information.
  • How comprehensive is the risk assessment? We perform a 4-phase risk assessment that involves information assets, security controls and policy objectives, thereby giving clients an unparalleled view of their security risks.
  • With more and more organizations choosing a combination of on prem and cloud, or moving to the cloud altogether, this phase has become a key focus area. Cloud brings in challenges related to control ownership, which we help in assessing in this phase.
  • Gap Analysis phase is a key phase in designing control responsibility to stakeholders.
  • This is where identified gaps, applicable controls (based on applicable criteria), with their references to stakeholders and policy/procedure requirements are determined, and documented.

PHASE III - Design, Documentation and Risk Monitoring

  • Design involves control allocation responsibility to organisation stakeholders.
  • Documentation involves drafting 25+ policies and procedures.
  • The phase involves brainstorming and training staff to align them with documented controls and policies.
  • Risks identified in the gap analysis are tracked towards closure.

PHASE IV - Control Measurement

  • Measurement involves testing the control effectiveness and giving a 0-100% score.
  • We have a structured methodology using that we score controls based on interplay of business transactions with SOC 2 controls, and present this to the management using a formal report.

PHASE V - Internal Audit and Management Review

  • Internal Audit involves verifying the effectiveness of the implemented lifecycle controls through interviews with physical and system verification of applicable controls, as it applies to the organisation control design.
  • A formal report is published for management committee.
  • We facilitate reviews with the management to ensure that the initial SOC 2 policy objectives and goals are achieved.

PHASE VI - CPA Support

Once the management framework is implemented, the chosen CPA firm performs audit, which includes the followings:

  • Documentation Review
  • Interviews
  • Testing control effectiveness

Once the CPA firm has completed the assessment, a draft report is issued, which is reviewed by the client, for final report. A typical report has 5 sections.

Finally, upon receiving their SOC 2 report, the clients are officially SOC 2 attested.

Conclusion

With all the 6 phases completed, the client is now ready for the firs year SOC 2 attestation.

Questions? Please contact us.

Training

We provide bespoke training, listed below are our offerings.

  • Shorter Sessions from 1 hour to 4 hours
  • Interpretation of the SOC 2 requirements
  • 1 Day Awareness Session
  • 2 Days Internal Audit Course
  • 3 Days Implementation Course covering 10+ hands on exercises

Upon receiving your request, we will provide you further details.

Documentation Toolkit

SOC 2 requires documentation of policies, procedures and records. As a result of several consulting assignments, we have some of the best content available that covers all the requirements.

Our documentation has the following salient features:

  • Alignment with all SOC 2 policy documentation requirements
  • Our experiences turned into documentation templates
  • Project Tracking tools to support the implementation
  • Q&A support

Upon receiving your request, we will provide you further details.

Internal Audit

An independent assessment helps to assess the state of compliance. Our internal audit methodology includes people, process, technology and measurements to assure and provide management the degree of SOC 2. Typically it takes 3-5 days to perform a comprehensive internal audit.

Upon receiving your request, we will provide you further details.

Risk Assessment

SOC 2 requires a comprehensive risk assessment of business objectives, information assets, network services, policies and procedures, organisation structure to name a few. We have a complete risk assessment methodology that helps you achieve demonstrate SOC 2 requirements.

Let us know if you are interested.

Upon receiving your request, we will provide you further details.

Program Management

Our consulting methodology experience has helped us to understand – what it takes to design and maintain a successful SOC 2 compliance. The outsourcing model removes the compliance responsibility to an external team, whereas the management focuses on customer/business delivery.

Upon receiving your request, we will provide you further details.

Call or write to us at :
for proposal / roadmap / information