Key Points
We’re proud to say that we’re now SOC 2 Type 2 certified – which we have renewed for 2024/2025 - with a little help from our own vulnerability scanner. But what exactly is SOC 2, and what does Type 2 certification mean?
SOC 2 is a cyber security framework designed to ensure service providers securely manage their data to protect customers and clients. For security-conscious businesses – and security should be a priority for every business today – SOC 2 is essential when working with a SaaS provider.
As a SaaS business ourselves, we recognize the benefits and confidence SOC 2 gives customers. It gives us a competitive advantage. It helps us to continually improve our own security practices. It helps us to meet customer demand. Most importantly, it gives current and prospective customers peace of mind. They can be confident that we have rock solid information security practices in place to keep their data safe and secure.
As with our Type 1 report, we used the Drata compliance platform for our Type 2 audit. It's fully automated to simplify what can otherwise be a slow and painful manual process of creating and updating spreadsheets and taking endless screenshots. The SOC 2 auditor can simply log in and monitor the controls via a dashboard. It makes the whole SOC 2 audit process so much simpler and quicker.
Type 1 or 2?
A SOC 2 Type 1 report evaluates cybersecurity controls at a single point in time. The goal is to determine whether the internal controls put in place to safeguard customer data are sufficient and designed correctly. Do they fulfil the required criteria?
Our Type 2 report goes a step further, where the auditor reports on how effective those controls are over time (usually 3-12 months). What is their operating effectiveness? Do they work as intended?
These reports are intended to meet the needs of a broad range of users that need detailed information and assurance about the controls at a service organization relevant to “security, availability, and processing integrity of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems”. These reports are important for:
- Oversight of the organization
- Supplier management
- Internal corporate governance
- Risk management processes
- Regulatory oversight
Not just for tech companies
If you think only tech companies like SaaS or cloud service providers need SOC 2 certification, think again. The main benefit of SOC 2 certification is that it shows that your organization maintains a high level of information security.
That’s why healthcare providers like hospitals or insurance companies may require a SOC 2 audit to ensure an additional level of scrutiny on their security systems. The same could be said for a financial services company or accountancies that handle payments and financial information. While they may meet industry requirements such as PCI DSS (Payment Card Industry Data Security Standard), they often opt to undergo SOC 2 for additional credibility or if clients insist on it.
Cost-effective compliance
The rigorous compliance requirements ensure that the sensitive information is being handled responsibly. Any organization that implements the necessary controls are therefore less likely to suffer data breaches or violate users’ privacy. This protects them from the negative effects of data losses, such as regulatory action and reputational damage.
SOC 2-compliant organizations can use this to prove to customers that they’re committed to information security, which in turn can create new business opportunities, because the framework states that compliant organizations can only share data with other organizations that have passed the audit.
Simplify SOC 2 with Intruder
One control you need for your SOC 2 report is vulnerability management. And for that you can use a scanner like Intruder – because that’s exactly what we did, using our own tool alongside the Drata platform. Intruder is easy to buy and simple to use. Just sign up, pay by credit card, and you can tick the SOC 2 vulnerability management box in under 10 minutes.
Type 2 is essentially continuous, so you will need vulnerability management to stay certified too because as soon as you get your report, the new monitoring period starts so you can get certified again 12 months later. Drata recommends quarterly scans at the very least to remain compliant and stay certified.
Intruder is also a great tool to use on a day-to-day basis. Not only for its continuous monitoring to ensure your perimeters are secure, but for other scenarios that may require a SOC 2 report such as due diligence. If your business is trying to secure new investment, going through a merger, or being acquired by another business, due diligence will often include your security posture, how you handle data, and your exposure to risk and threats. Intruder makes it easy to prove you take your information security seriously.
Learn more about how Intruder can help with SOC 2 certification
Patrick has been heading up software engineering teams in the cybersecurity industry for over a decade. He also has a PhD in Computer Science working with artificial intelligence models.
