Realizing the benefits of SOC 2+ reporting

As its name suggests, a SOC 2+ report is a variation of a SOC 2 report that incorporates a second control framework in addition to the American Institute of CPAs (AICPA) trust services criteria categories used in SOC 2 reports. The trust services categories address controls related to one or more of the following aspects of a service organization’s services and the related customer and end-user information handled as part of those services:

• Security
• Availability
• Confidentiality
• Processing integrity
• Privacy

Including a second framework via a SOC 2+ report provides additional assurance beyond what is typically included in a SOC 2 report. As a result, third parties have greater flexibility and coverage in addressing their customers’ assurance needs, helping to reduce individual customer audit and questionnaire requests.

Here’s another advantage: While the degree of overlap between an organization’s existing SOC 2 controls and the requirements of the selected second framework varies, there is significant overlap with the most common SOC 2+ options. For most organizations, this results in a near “two-for-one” deal, as they can add a second framework that provides an in-depth view of their controls without a significant increase in effort to undergo annual SOC examination procedures or maintain ongoing compliance.

A closer look: Second framework options

Service organizations that opt for a SOC 2+ report should select the second framework that best aligns with their industry, regulatory and compliance requirements, and customer expectations.

For example, customers might contractually require certain security practices that are mandated through a specific industry framework, such as HIPAA or the HITRUST CSF^® for healthcare. By including the industry framework in a SOC 2+ report, service organizations can centrally address customer needs.

In other cases, a service organization might already have developed and aligned its information security program to an established framework, such as International Organization for Standardization (ISO) 27001 or the National Institute of Standards and Technology (NIST) Cybersecurity Framework, allowing the organization to take credit for its existing controls through a SOC 2+ report and distinguish itself from other organizations with traditional SOC 2 reports.

Following are the most common frameworks included in SOC 2+ reports, along with the key drivers for selection and the additional controls included in that framework compared to a typical SOC 2 report.

One important disclaimer for frameworks that offer certification options (for example, ISO 27001 or the HITRUST CSF): Including a certifiable framework within a SOC 2+ report will not result in certification; it will result only in an independent opinion on the controls in place to address that framework’s requirements. If an organization specifically requires certification, the service organization would need to separately pursue and meet that organization’s requirements for certification.