SOC for Service Organizations (SOC 2) – Boston, MA

Many businesses and organizations in Boston and across Massachusetts provide services that require the updating, and processing of sensitive personally identifiable information (PII). This may include social security, bank account, credit card numbers, home address, and more. Ensuring adequate protections are in place is not only necessary to prevent breaches, but also to ensure customers and prospects about the quality of cybersecurity controls. In fact, many expect to see a System Organization Control (SOC 2) report before doing business with a company.

What is a SOC 2 Report?

This report provides essential information to customers, vendors, and others, that require assurance about the security of controls, availability, and integrity of systems used to process confidential data. They play an important role on organizational oversight, vendor management programs, risk management, internal corporate governance, and regulatory oversight. Only a licensed CPA firm is permitted to conduct these assessments and render an opinion on the quality of controls.

Boston SOC Experience

Our team has significant experience conducting SOC 2 examinations for Boston businesses. Specifically, we can assist with:

• SOC 2 Reports – Prepared for service organizations for which a detailed understanding and assurance around internal controls at the organization is necessary. Depending on the need, Calvetti Ferguson can conduct a SOC 2 Type I or SOC 2 Type II examination. The main difference between the two is that a Type I report covers a specific period, whereas Type II reports cover a minimum six-month period.
• SOC 2 Plus -These examinations include one to all five of the Trust Services Categories and Criteria, plus additional criteria for frameworks such as HITRUST, PCI, ISO 27001, NIST or other established control frameworks.