SOC-2 Signed Electronically Made Easy

Soc countersignature

the original standard was known as SAS 70 statement on auditing standards which in 2011 was replaced by sock to service organizational controls - this was developed in America and by the American Institute of Certified Public Accountants sagt who defines the criteria for managing customers data based on the five service principles security availability processing integrity confidentiality and privacy unlike PCI DSS which has very rigid security control requirements - reports are unique to each organization these are in line with specific business practices Eve designs its own controls to comply with one or more of the trust principles first is security the security principle refers to the protection of system resources against unauthorized access access controls help prevent potential system abuse theft or unauthorized removal of data misuse of software and improper alteration or disclosure of information IT security tools such as network and web application firewalls two-factor authentication and intrusion detection software are useful in preventing security breaches that can lead to unauthorized access of systems and data the next ons availability the availability principle refers to the accessibility of the managed service as stipulated by the contract or service level agreements SLA z' as such the minimum acceptable performance level for systems availability is set by both parties this principle doesn't address sips system functionality and usability but does involve security related criteria that may affect availability monitoring network performance and availability site failover security incidents handling are critical in this context you then get processing integrity the processing integrity principle addresses whether or not a system achieves its purpose does it deliver the right data at the right price at the right time accordingly data processing must be complete valid accurate timely and authorized however processing integrity does not necessarily imply beta Integra if data contains error prior to be an input into the system detecting them is not usually the responsibility of the processing entity monitoring of data processing coupled with Quality Assurance procedures can help ensure processing integrity confidentiality data is considered confidential if access and disclosure is restricted to a specific set of people or people within the organization examples may include data that's only intended for company personnel or its business plans or intellectual property it might be financial data encryption is an important control for protecting confidentiality during transmission network and application firewalls together with rigorous access controls can be used to safeguard information being processed or stored on a computer system and finally privacy the privacy principle addresses the system's collection use retention disclosure and disposal of personal information in conformity with an organization's privacy policy as well as within the criteria that's set by sock to the process to becoming Socrates certified is quite a long and arduous process our audit actually lasted six months it starts with the order - looking at your principles your procedures to see how they're carried out on a day to day basis and whether they conform with these standards that have been laid out the audit will then go on and to the point where during your final audit they're actually looking at your live system they want to connect into your cloud they want to see the Reax s certain people within your company have two firewalls two networking equipment so they really go into depth and make sure that not only your paper works up to scratch but so is the infrastructure that you'll be hosting the data being socked to certified for hive managed hosting is really a big thing a lot like in the UK where ISO 27001 is the gold standard in information security in the u.s. that sock to but I think customers can take a huge amount of comfort from a company that is socked to certified because as I said before it's not just looking at your policies and procedures it's looking at your day-to-day running of your company it's looking at your staff it's looking at your security and physical security items that you have within your building and then it's also looking on the infrastructure that the date has held on so it's an all-encompassing certification another point about hive managed hosting being socked to certified can be looked at like this data centers are incredibly secure just to gain physical access to them is very very difficult you've got to have biometric scanners you have ID cards pre-arranged appointment you might have to be escorted and this is just again physical access they hold the access of data just as securely you'll find that the Tier three enhanced data centers are all stocked to an ISO 27001 certified so as the man in the middle as the company that's providing the managed hosting services surely hive should hold these same accreditations so the customer knows that the the way the data center handles security so does hive so I think sock two sits beautifully along ISO 27001 because it covers all of the information security basis that customers need but also it's a big demonstration to your customers to say that we take this seriously it doesn't matter whether you're in the US or Europe or the rest of the world high vantage hosting takes the security of customers data and indeed their own data really seriously and that's really important to us so if you've got any questions on how hive sock 2 certification can help you your company and your data give us a call drop us an email