Für die Sicherheit und den Schutz der Gemeinschaften. Gemeinsam!

A SOC2 Type II report is an internal controls report, based on AT 101 reporting standard, capturing how a company safeguards customer data and how well those controls are operating. Companies that use cloud service providers use SOC2 reports to assess and address the risks associated with third party technology services. These reports are issued by an independent third party auditor covering the principles of Security, Availability, Confidentiality, and Privacy.

The SOC3 report provides a high-level summary of a company’s internal controls regarding security, availability, processing integrity, confidentiality, and privacy. Unlike SOC2, which contains detailed and restricted information, the SOC3 is designed for public distribution and demonstrates commitment to the AICPA Trust Services Criteria. These reports are issued by independent third-party auditors and serve as a public-facing attestation of a service organization’s operational effectiveness over a specified period.

ISO/IEC 27001 is a security standard that formally specifies an Information Security Management System (ISMS) that is intended to bring information security under explicit management control. As a formal specification, it mandates requirements that define how to implement, monitor, maintain, and continually improve the ISMS. It also prescribes a set of best practices that include documentation requirements, divisions of responsibility, availability, access control, security, auditing, and corrective and preventive measures.

This international standard provides additional cloud-specific implementation guidance based on ISO/IEC 27002, and provides additional controls to address cloud-specific information security threats and risks referring to clauses 5-18 in ISO/IEC 27002: 2013 for controls, implementation guidance, and other information.

ISO adopted ISO/IEC 27018:2014, an addendum to ISO/IEC 27001, a framework for cloud privacy. Based mainly on EU data-protection laws, it gives specific controls and guidelines to cloud service providers (CSPs) acting as processors of personally identifiable information (PII).