Security Practices for
AICPA SOC-2 Compliance

If you are a service provider with an online presence particularly in North America, almost certainly your customers will expect you to have a SOC-2 compliance report. There is no legal or regulatory requirement to do so, but as the most common attestation in North America, having a SOC-2 compliance attestation sends a strong signal that you prioritize the SOC-2 key attributes: security, availability, processing integrity, confidentiality, and privacy.

SOC 2 requires companies to establish and follow strict information security policies and procedures, not just ticking compliance checkboxes. SOC-2 puts into place long term, ongoing internal processes encompassing the security, availability, processing, integrity, and confidentiality of customer data.