Liminal is a SOC2-compliant organization: What are your takeaways from that?

Let’s start from a historical note to have a broader understanding; in April 2010, AICPA announced a new auditing standard- the Statement on Standards for Attestation Engagement. Under this, the AICPA released three new reports, resulting in the Service Organization Controls (SOC) and the ever-popular SOC 2. Later in May 2017, the AICPA replaced SSAE 16 with SSAE 18 to update and simplify some confusing aspects of SSAE 16.

SOC 2, or Service Organization Control 2, is a security framework for organizations providing technology-based services and storing client data. Unlike any other “join the dots” task, it is a complicated set of standards that must be critically reviewed and addressed. And, no matter how complicated it is, we at Liminal believe in the security-first approach, and SOC2 seemed a very important milestone to achieve. Hence, we are excited to put it out that we are a SOC2-compliant organization.

What is SOC2 and its trust service principles?

It is a voluntary compliance standard for service organizations, which outlines how businesses should handle customer data. SOC 2 is made to reassure your clients that you are keeping a check for suspicious behaviour and are prepared to act fast in the event of a crisis.

It is based on the five “trust service principles.” Which are security, availability, processing integrity, confidentiality and privacy. Let’s see them in brief-

1. Security: It deals with preventing unwanted access to system resources. Access controls to aid in preventing potential system abuse, data theft or unauthorized removal, software misuse, and incorrect information manipulation or disclosure. Two-factor authentication, network and web application firewalls, and other IT security solutions are advised to achieve this.
2. Availability: The concept of availability applies to a system’s, a product’s, or a service’s ability to be accessed in accordance with a contract or service level agreement (SLA). As a result, both parties agree on the minimum acceptable performance level for system availability. In this framework, it is crucial to monitor network availability and performance as well as handle security incident response and site failover.
3. Processing integrity: The processing integrity concept examines if a system fulfils its objective of delivering the right data at the right price and time. As a result, data processing needs to be approved, legitimate, comprehensive, and accurate. Processing integrity can be ensured with the use of monitoring data processing and quality assurance techniques.
4. Confidentiality: Data is regarded as confidential if access to and disclosure of the information is limited to a particular group of people or organizations. Examples could include information only intended for corporate employees, business strategies, intellectual property, internal price lists, and other sensitive financial data. Encryption is a crucial safeguard for maintaining transmission confidentiality. Network and application firewalls can be employed with stringent access controls to protect data being processed or stored on computer systems.
5. Privacy: The privacy principle focuses on how the system collects, uses, retains, discloses, and discards personal data following the organization’s privacy notice and standards outlined in the AICPA’s generally recognized privacy principles (GAPP). Details that can identify an individual are referred to as Personal Identifiable Information or PII (e.g., name, address, Social Security number). A higher level of security is typically required for sensitive personal information, including information about health, race, sexual orientation, and religion. All PII must be shielded from unwanted access via controls.

What changes when you become a SOC2-compliant organization?

Well, to answer this question, we will have to look into some of the key benefits of this compliance.

1. Better Reputation: The key advantage of SOC 2 compliance is that it shows that your company upholds a high data security standard. Sensitive information is handled responsibly thanks to the tough compliance requirements, which are put to the test during an on-site audit.
2. Customer Demand: Your clients place a high value on preventing unauthorized access to and theft of consumer data. Therefore, you risk losing business without a SOC 2 certification.
3. Sense of Security: Your networks and systems are secure if you successfully pass a SOC 2 audit. In addition, the SOC2 report reassures the client that the company has satisfied standards for security that guarantee the system is shielded from unauthorized access (both physical and logical).
4. Enhanced Services: A SOC 2 Audit can help you strengthen your security controls and operational effectiveness. Based on understanding the cyber security risks your clients face, your company will be well-positioned to streamline operations and controls. Your services will be enhanced as a result.
5. Competitive Advantage: Although many businesses assert that they are secure, they cannot demonstrate this without passing a SOC2 Audit and obtaining a SOC2 Certificate. Hence, it gives your business an advantage over rivals who are unable to remain compliant.

What does it require to be compliant?

SOC 2 mandates that you create and follow documented security policies and procedures, which will be reviewed by auditors. These policies and procedures should cover the following areas: security, availability, processing integrity, confidentiality, and privacy of data stored in the cloud and on-premise infrastructure. Besides, it necessitates that you create alerts for

• Exposure or modification of data, controls, configurations
• File transfer activities
• Privileged filesystem, account, or login access
• Availability monitoring of critical infrastructure
• Malware activities on the employee endpoints

Overview

Data security is essential for enterprises of all sizes. Keeping your data secure is essential to succeeding in the digital ecosystem, regardless of whether you’re a small business, a huge organization, or a cloud computing provider.

Lastly, in the words of our founder, “At a time where security threats surround the Blockchain & Crypto landscape, SOC 2 Type II certification displays the gold standard for security and privacy. After achieving this internationally acclaimed certification, we are even more proud to present our robust wallet infrastructure that safeguards digital assets and personal data.”

Become #LiminalSecure today, as it is the new definition of security!

Learn more about Liminal here. Remember to keep yourself updated on our blog and social media channels.