Benefits and Challenges on the Road to Peace of Mind

Note: This is the third part in a series of blog posts Alliant will publish on its experiences achieving SOC 2 certification. You can download the entire series here.

Most certifications entail a two-step process. First your organization goes through an audit by an independent professional. Then, based on the results of that audit, your team can address any issues and prepare for the appropriate certification.

An immediate benefit of the audit process is peace of mind. Without that scrutiny, it can be difficult to ascertain what you don’t know about your information assets. What are your crown jewels? Where are they located? Who can access them? Many organizations are surprised when they systematically dig through their data flows and comprehensively answer these questions for the first time. The process of compiling the information and ensuring that your organization will be ready to deliver the required documentation to an auditor is a big task, and one that can be useful internally.

The audit and test processes that are part of certification deliver valuable insight that bring clarity to your data handling processes. Consider the value of being able to:

• Produce a comprehensive data-flow diagram

• Document all procedures that allow access rights to valuable IP

• Expose a potential network weakness after a third-party penetration test or quarterly vulnerability scans

If your organization chooses to seek certification, you must have management buy-in, because you’re going to need to justify significant time commitments, and potentially expenditures, from your network and IT staff — reviewing standards, producing logs, and validating processes. And the number of departments touched by any of the cybersecurity standards far exceeds just your IT team — HR, finance, legal and compliance, and even sales all have a role to play. Trainings, new security requirements, and reductions to data permissioning will all demand time.

Without certification, your organization will struggle to answer basic questions about your cyber-defense posture. The risks an organization is taking regarding its networks, intellectual property, and consumer data, are largely unknowable before it completes its first audit.

And the potential effects of not knowing can be catastrophic for your organization.

But having come out the other side, the rewards are well worth the effort.

*This post is provided for informational purposes only and is not legal advice. Each organization should work with qualified counsel to understand its obligations and opportunities for improved data quality and approved certifications.

What is SOC 2?

SOC 2 is an auditing procedure that ensures a service provider securely manages data to protect its clients. For security-conscious businesses, SOC 2 compliance is a mandatory requirement when considering a service provider. The SOC 2 standard is based on the criteria outlined in the Description Criteria authored by the AICPA, the American Institute of Certified Public Accountants