CAPABILITIES
SOC Services
We help you become a better vendor.
In today’s connected business ecosystem, more and more organizations engage third parties to conduct key aspects of their operations. Because of the potential exposure, a growing number of firms view System and Organization Controls (SOC) reports as the price of admission for potential vendors.
At HORNE, we help you go beyond simply “checking all the boxes” and providing an unqualified report. We uncover opportunities to raise the bar on security, processes and practices. While our immediate focus is preparing you for or conducting your SOC report, our ultimate aim is to help you become a better vendor for your current customers and a more attractive choice for future ones.
Choosing the Right SOC Report for Your Organization
SOC reports provide management, auditors, business partners and executives with an objective analysis of your IT environment, and ensure them that transparency, accountability and controls are in place. For most organizations, the first challenge is defining the scope. HORNE helps you navigate the complexities and obtain the report that is appropriate for your needs.
SOC 1 Examinations:
Type 1 and Type 2
SOC 1 reports evaluate internal controls in relation to financial reporting. Service organizations may need a SOC 1 report if their provided service may have a material impact on the financial statements of the user entity, such as those that offer accounting software or payroll processing to user entities including loan servicing companies and medical claims processors.
SOC 2 Examinations:
Type 1 and Type 2
SOC 2 reports evaluate internal controls in relation to security, availability, processing integrity, confidentiality and privacy criteria. These typically are required of organizations that provide services that affect compliance and operational controls, such as data centers, server hosts and IT managed services providers.
SOC for
Cybersecurity
SOC for cybersecurity provides insights into your security posture and helps guide decisions that can drive board- or executive-level strategic cyber-resilience initiatives. This report demonstrates key strengths, vulnerabilities and opportunities of your IT environment, including:
- Types of information and data at risk
- Cybersecurity risk management program objectives
- Factors that have a significant effect on inherent cybersecurity risks
- Cybersecurity risk governance structure
- Cybersecurity risk assessment processes
- Monitoring of cybersecurity risk management program
- Cybersecurity control processes
These reports help guide decision making and IT spending by outlining gaps in your organization’s cybersecurity risk management program.
The SOC Examination Process
While each SOC examination has its specific goals, the preparation is similar for all. Our SOC examination process includes:
