Overview

As a SOC 2 consulting service provider, we advise our clients in SOC 2 attestation through a 6-phase implementation approach that includes understanding client business, setting business and security policy objectives, determining applicable SOC 2 trust principles, gap analysis, detail risk assessment, risk remediation support, policy documentation, end user training, monitoring, measurement, and audit, thereby leading to successful SOC 2 attestation.
With 20 years of security, governance risk and compliance practice, our methodology has been successfully implemented in business of all sizes and sectors, across the globe. Whether you are a startup in AI-ML-Data Science, SAAS, PAAS, IAAS provider, product developer or customer, or brick and mortar local or global business, we have implemented SOC 2 in fairly all industry sectors.
Security and compliance is everyone’s responsibility. We consider our methodology as most comprehensive as we involve every client key stakeholder in our SOC 2 implementation journey. We ensure ‘security by design’, and ‘privacy by design’ principles as part of client’s business DNA.
How fast can Coral get us SOC 2 certified? We follow an agile philosophy where phases of the project can run in parallel, resulting in achieving SOC 2 certification faster.
Contact us today to get started.

Kindly share your details for SOC2 requirements

Name

Organisation

Phone

Email

Please provide your additional request OR specific request (if any) : *

Security Code

What are the SOC 2 Trust Principles

SOC 2 has the following 5 principles, listed below are the principles and their objectives.

Common Criteria Security: The system is protected, both logically and physically, against unauthorised access.
Availability: The system is available for operation and use as committed or agreed to.
Processing Integrity: System processing is complete, accurate, timely, and authorized.
Confidentiality: Information that is designated ‘confidential’ is protected as committed or agreed.
Privacy: Personal information is collected, used, retained, and disclosed in conformity with the commitments in the entity’s privacy notice and with the privacy principles put forth by the American Institute of Certified Public Accountants, and the Canadian Institute of Chartered Public Accountants (CICA).

Each of these principles has more detail risks/controls that need to be fulfilled.

SOC 2 Consulting Engagement Phases

Here is a brief overview of all the phases involved in implementing SOC 2 attestation.

PHASE I - Understanding Business, and Security Requirements and SOC 2 Report Objectives

Every client is unique with its business model, customers and business objectives.
The SOC 2 implementation journey starts with this phase where we determine and document the clients’ business requirements for SOC 2 including the applicable criteria.
SOC 2 Attestation requirement - Type 1 or Type 2

PHASE II -
Gap Analysis and Risk Assessment

As the name suggests, this phase is aimed at determining both the current controls and the ‘missing controls’.
In addition this phase involves determining information and its lifecycle, with its assets that store, process and/or transmit the information.
How comprehensive is the risk assessment? We perform a 4-phase risk assessment that involves information assets, security controls and policy objectives, thereby giving clients an unparalleled view of their security risks.
With more and more organizations choosing a combination of on prem and cloud, or moving to the cloud altogether, this phase has become a key focus area. Cloud brings in challenges related to control ownership, which we help in assessing in this phase.
Gap Analysis phase is a key phase in designing control responsibility to stakeholders.
This is where identified gaps, applicable controls (based on applicable criteria), with their references to stakeholders and policy/procedure requirements are determined, and documented.

PHASE III - Design, Documentation and Risk Monitoring

Design involves control allocation responsibility to organisation stakeholders.
Documentation involves drafting 25+ policies and procedures.
The phase involves brainstorming and training staff to align them with documented controls and policies.
Risks identified in the gap analysis are tracked towards closure.

PHASE IV - Control Measurement

Measurement involves testing the control effectiveness and giving a 0-100% score.
We have a structured methodology using that we score controls based on interplay of business transactions with SOC 2 controls, and present this to the management using a formal report.

PHASE V - Internal Audit and Management Review

Internal Audit involves verifying the effectiveness of the implemented lifecycle controls through interviews with physical and system verification of applicable controls, as it applies to the organisation control design.
A formal report is published for management committee.
We facilitate reviews with the management to ensure that the initial SOC 2 policy objectives and goals are achieved.

PHASE VI - CPA Support

Once the management framework is implemented, the chosen CPA firm performs audit, which includes the followings:

Documentation Review
Interviews
Testing control effectiveness

Once the CPA firm has completed the assessment, a draft report is issued, which is reviewed by the client, for final report. A typical report has 5 sections.

Finally, upon receiving their SOC 2 report, the clients are officially SOC 2 attested.

Questions?

Seek a one to one session with our Principal Consultant, who will answer your questions to get started.

Contact Us Now !

Training

We provide bespoke training, listed below are our offerings.

Shorter Sessions from 1 hour to 4 hours
Interpretation of the SOC 2 requirements
1 Day Awareness Session
2 Days Internal Audit Course
3 Days Implementation Course covering 10+ hands on exercises