I’m extremely proud to announce that Pagefreezer is now SOC 2 Type 1 and Type 2 compliant. We have always made use of compliant data centers to store information, but over the last year our organization itself has now gone through the rigorous SOC 2 auditing process to achieve compliance.
Where ISO is a recognized framework for implementing an effective information security management system, SOC is a more detailed assessment with a customer-focussed approach that looks at the logical and physical controls a service organization has put in place. It examines how the company controls and limits access to data, how those users are authenticated, and how any inappropriate activity is reported and managed.
SOC stands for System and Organization Controls, and was developed by the American Institute of Chartered Public Accountants (AICPA). It is governed by this accounting institute because it originally started with SOC 1, which examines a service organization’s controls related to the potential audit of a customer’s financial statements. SOC 2, however, reports on the effectiveness of security controls created by a service organization to protect the security and confidentiality of information.
SOC 2 defines criteria for service organizations to manage customer data based on five Trust Services Principles and the outcome of the audit process is an independent auditor’s SOC 2 report.
Saying that, it’s important to distinguish between SOC 2 Type 1 and Type 2. Type 1 is a point-in time audit reporting that organizational controls are adequately designed to meet the trust services requirements at the time of the report—we received this Type 1 report in October 2019. Type 2 is a full audit involving examination and testing of the controls described. It reports results of the operating effectiveness of the controls over a period of time.
Our goal is to offer transparency by providing a third-party's detailed account of Pagefreezer’s controls related to security and confidentiality.
Many organizations offer security policies and practices on their websites. But if these are self-reported, a customer has no real insight into the efficacy of the controls. ISO 27001 certification and a SOC 2 report provide third-party evidence that Pagefreezer is living up to our security commitments.
Potential customers often have questions about our security policies; about how we respond to incidents, protect data, and control access. The SOC 2 report is a lengthy and detailed document that offers answers to these questions and the opportunity to understand our company, the systems we have in place, our operations, and our technical controls. They can then use this information to assess risk and know they’re making the right choice in Pagefreezer as a vendor. Our SOC 2 Type 2 report also gives existing customers assurance that the controls we have in place are implemented and operating effectively to meet the criteria for security and confidentiality of their data.
In Pagefreezer’s case, the independent auditor’s report is a lengthy 125-page document. It attests that Pagefreezer has put in place controls for information security and confidentiality that are suitably designed (according to the trust services criteria), and that after in-depth testing and examination, these controls operated effectively throughout the review period.
The report provides a detailed description of the controls in place that meet the SOC Trust Services Criteria, including the product and services we provide, our corporate oversight and internal corporate governance, descriptions of our infrastructure and systems, the technical safeguards in place, vendor management, risk management, and policies and procedures in place for management of security and confidentiality across the organization.
At the start of the process, we provided descriptions of controls—every aspect of the company and policies and practices in place—and these were reviewed to make sure controls were adequate. We then provided evidence, as requested, covering a three-month period. Our Security Team and process owners for all control areas took part in an inquiry process with the auditors who observed processes, inspected systems and records, and tested controls. After this period, the audit company then provided feedback and created the report based on evidence provided and our descriptions of systems. The auditor found that we met all the criteria and that there were no exceptions in our test results.
For more information about security at Pagefreezer, please visit our Security Page. Below I’ve also put together some tips for any company preparing to embark on certification: