When it comes to processes involving the SOC 2 report, many companies still have questions on what they should and should not be doing to meet Trust Services Criteria. Companies who use the SOC 2 report are adding another layer of protection to their protocols. A SOC 2 report is not a certification but outlines what types of controls that a firm needs.
See our foundational guide, SOC’s trust service principles: and the Differences Between Penetration Tests and Vulnerability Scans
Penetration Tests
Penetration testing aims to locate weaknesses that can be exploited. An effective pen test should:
- Create a listing of vulnerabilities based on the severity.
- Aid in identifying the path of the attacker used to take over a system(s).
- Be conducted after an assessment, and after the organization has designed acceptable security practices.
- Provide a secondary level of identification for possible vulnerabilities.
- Accomplish specific goals in identifying vulnerabilities.
Vulnerability Assessments
A vulnerability assessment is designed to identify, quantify, and prioritize vulnerabilities in each system and the entire environment. This type of assessment provides a prioritized list of patches and systems that require attention and when they should be addressed. An effective vulnerability assessment should:
- Start the process of identifying systems with security issues.
- Identify the impact of systems with security issues and their impact of risk to the organization.
- Work to find and measure vulnerabilities within a system(s).
- Exploit vulnerabilities to breach systems and break security controls.
- Uncover, identify, define and prioritize system vulnerabilities or gaps to prioritize any security issues.
Learn more about the Key Differences Between Vulnerability Scans and Penetration Tests.
How Pen Tests and Vulnerability Assessments Help an Organization
As businesses evolve, the use of third parties has increased. These third-party providers help in managing data and business processes but can increase vulnerabilities within the main organization. The key is to have the right protocols in place to identify when and where this can occur. With data breaches being a main focal point and occurring at high rates, the need for security testing is clear. If organizations do not monitor the susceptibility of attacks that can occur through a third party, they are leaving the organization inadequately protected.
Companies often have IT failures which may seem insignificant, but which actually put the organization at risk. These include the use of protocols that are not secure, delays in patching identified security flaws, allowing licenses to lapse for important prevention tools such as antivirus or IPS, lax policies in software management, weak passwords, coding guidelines, and QA review processes. One of the most harmful examples is vulnerabilities in how IT management complies with security protocols and controls. Are these preventable? Absolutely. A regularly scheduled vulnerability assessment can aid in validating how the current security practices operate and identify any new issues that have formed as a result of changes or upgrades to the system.
Compliance is also a huge player in this space. Recognized frameworks require regular vulnerability assessments of the production network or web application being used. SOC 1 and SOC 2 are part of these recognized frameworks. Knowing the commonly identified risks may serve as a blueprint with which to start. These risks include unknown open shares, expired, self-signed or SSL Certificates that have not been properly configured, dormant user accounts that have not expired, incorrect permissions on critical system files, default password being used and unpatched services or applications, dangerous script configurations, servers allowing dangerous protocols to be used, and open ports that are not necessary.
Even with a strong security or controls background, companies should consider how prepared their team is for cybersecurity risk. Although the decision to have vulnerability assessments and penetration tests on a regular basis lies within the hands of the firm, regular vulnerability scans will meet the intent of CC7.1. Additionally, unless the firm has other security assessments on a recurring basis that meet the requirements of CC4.1, they may bypass the annual penetration test.
Clarifying the Intent
Although the SOC 2 Criteria does not specifically mandate that firms who obtain a SOC 2 report need vulnerability scans or a pen test, firms must consider the risks involved if they do not. As this is an industry-standard basis for evaluating infrastructure integrity, working with audit firms that do not require vulnerability scans or penetration tests are questionable. The SOC 2 report criteria do mention both in the Points of Focus, which indicates they are key components. The first step is ensuring that your organization is assembling a strong SOC 2 team that understands the importance of certification and its impact on the company.
This will circumvent any confusion on whether the pen test or vulnerability assessments are needed to become SOC 2 compliant. It is up to the management team at the C-Suite level to fully understand the reasons why SOC 2 certification is critical to the organization and having the right protocols and testing in place is instrumental in setting high standards moving forward. Even if vulnerability scans are mandatory in meeting CC7.1 standards and penetration tests are not, both work in conjunction in terms of security assessments. This is true even if other assessment protocols such as internal audits, ISO certifications, and others are being used. Many organizations implement more than one type of evaluation. The goal is to ensure total compliance at every step while having effective layers of security-based operational standards.
Related article: Ensure Your Team Is Meeting Compliance Controls & Processes.
Evaluating your Choices
Having the right people in place that help make the tough decisions about what is required for compliance is key. By working with consultants like I.S. Partners to help complete the SOC 2 certification process, the team will better understand the scope, timelines, and requirements needed to be successful. To find out more, fill out the form to request a quote online.
SOC 1®, SOC 2® and SOC 3® are registered trademarks of the AICPA (American Institute of Certified Public Accountants). The AICPA® Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy is copyrighted by the Association of International Certified Professional Accountants. All rights reserved.
