Types of SOC Reports

SOC 1 report checks for a company's internal control over financial reporting. It is the audit of a third-party vendor’s accounting and financial controls which impact the user entity.

SOC 2 deals with the checking of the controls of a service organization over, one or more of the ensuing Trust Service Criteria (TSCs):

Privacy

Confidentiality

Processing Integrity

Availability

Security (mandatory criteria))

SOC 3 is a summarized report of the SOC 2 Type II report and is designated to be a less technical and less detailed audit report with a seal of approval which could be put up on the vendor's website for public display.

Classification of SOC 1 and SOC 2 Reports

Type I - This pertains to the audit taken place on a particular point of time, that is, at a specific single date and confirms that the controls exist.

Type II - A Type II report is more rigorous and is based on rigorous testing of controls over a duration of time and are generally more reliable as they pertain to the efficiency and effectiveness of controls over a more extended period of time taken into consideration.

Types of Testing performed by us based on Sampling Method:

Administrative Items

Change Management Testing

New/Existing/Terminated Employee Testing

Admin Access Testing

SOC Memos (Mostly based on the SOC 1, Type II Reports already prepared by CPA firms based in US and provided to us by the client, we then prepare the Memos as per the defined format)

HITRUST CSF Reporting :

WHAT & WHY?

The HITRUST Common Security Framework offers a defined and comprehensive set of controls designed to meet the requirements of multiple regulations and standards. By leveraging the HITRUST framework, organizations can effectively comply with various standards, including ISO/IEC 27000 series and HIPAA. It amalgamates security, privacy, and regulatory requirements from existing frameworks and standards, enabling organizations to demonstrate their security and compliance consistently and efficiently.

HOW?

HITRUST CSF is a comprehensive and a certifiable framework that can be used by all organizations that create, access, and store or exchange sensitive and/or regulated data from/within their systems.

Regulator?

Governed by an Executive Council and led by a management team comprising leaders from across various industries.

Types of Policy/Procedures Testing we conduct :

Readiness Assessment :This assessment serves as a pre-check for organizations preparing for a Validated Assessment. We thoroughly examine policies and procedures to ensure compliance with defined standards and verify the implementation of appropriate procedures aligned with the policies.

Validated Assessment :This comprehensive assessment results in HITRUST Certification, confirming an entity's compliance with HITRUST CSF's security baselines and the presence of suitable policies and procedures to adhere to various Security & Privacy Regulations. The assessment is conducted by a HITRUST Certified External Assessor, specifically a Certified CSF Practitioner (CCSFP).

HITRUST Documentation Upload – This is done by uploading the testing evidences at the HITRUST Portal and further submitting the Assessment Object online for Certification. Then, the HITRUST reviews the assessment and provides a Certification to the assessed entity if all the compliance requirements are found adequate.