Common Vendor Risk Management SOC Questions & Answers

Let's spend a couple minutes on discussing SOC reports from an examiner's perspective and what we are seeing for 2017.  

Subheading

Here's an example question that I'm getting from our clients regarding examiner expectations. So one of the questions you can see here is: 

• So does this mean that our SOC 1 just flat out replaces our previous SAS70? And the answer is unfortunately somewhere in the middle. Again, because the SAS70 became this gorilla before and scoped so many different ways, when they retooled it into these new SOC reports, now you really need to know what to request. Because sometimes people just simply replace SAS70 with SSAE16 and effectively we’re not getting the same report. When they really need to ask for both the SOC 1 and SOC 2 report, to be able to not only look at the financial controls of a SOC 1 but also the compliance and information security controls of a SOC 2. So it’s case by case. It’s driven by criticality of vendor. Not all vendors need a SOC 2, not all vendors need a SOC 1 frankly. So, it really just depends on that vendors relationship with you and where it falls in your risk matrix.  
• And, another question that I get is, is SOC 3 reports good for anything then? And, certainly I think there’s value there, often times when SOC 2 and SOC 3 reports are done because we are doing SOC 2 work, and naturally a SOC 3 report will be produced at the same time since you’re kinda covering the same areas anyway, there’s just some additional reporting time, so I always tell folks from an initial due diligence standpoint it’s great, if you’re just going out and trying to find a half dozen vendors that do mobile, whatever the case may be, an encryption company, having that could be a vetting part for you to kind of whittle down to folks that are kind of thinking the same way you need them to think and so having a SOC 3 report like that is kind of an early indicator that they are maybe doing the right things. And I should emphasis MAYBE doing the right things. But later on, as you get it down to 2 or 3 vendors you certainly want to get some more information and detail from those other types of reports.  

 Subheading

So in short, I would just simply recap and say, SOC 1 and SOC 2’s, I would get in the process of asking every single time for any of your critical vendor’s.  

Learn more about analyzing SOC reports. Download our eBook.