Cloud Security Alliance Releases Illustrative Type 2 SOC 2® Report That Incorporates Its Cloud Controls Matrix Criteria

Document provides American Institute of Certified Public Accountants-approved guidelines for SOC 2 reporting

SEATTLE – August 9, 2022 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released the Illustrative Type 2 SOC 2® report with the Additional Criteria in the CSA Cloud Controls Matrix (CCM). Drafted with input from the American Institute of CPAs (AICPA), the report offers specific guidelines for Type 2 SOC 2 reporting, including the suitability of the design and operating effectiveness of controls, and their implementation in accordance with specifications set forth in the Cloud Controls Matrix (CCM), a cybersecurity control framework for cloud computing.

“Our collaboration with the AICPA means both providers and consumers of cloud services can be confident that their CPAs are conducting SOC 2 audits following the best practices for cloud security. Now, with the updated guidance, CPAs are even better positioned to carry out SOC 2 engagements, and validate the security posture of a cloud security provider’s (CSP) cloud offering. The end result is that organizations will have greater confidence in their preferred CSP, which in turn helps to mitigate data security and privacy risk,” said Jim Reavis, CEO, Cloud Security Alliance.

“Our ongoing collaboration with CSA keeps security in cloud computing at the forefront and offers a strong foundation for CPAs when conducting SOC 2 engagements,” said Amy Pawlicki, vice president of assurance and advisory innovation at AICPA & CIMA, which together form the Association of International Certified Professional Accountants. “It also gives providers a strong tool to demonstrate the effectiveness of their security controls.”

Several years ago, CSA and AICPA collaborated to develop the CSA Security Trust Assurance and Risk (STAR) Attestation, a third-party assessment program of CSPs. Today, companies wishing to become accredited CSPs in accordance with the CSA’s Security, Trust, Assurance and Risk (STAR) program must adhere to the additional criteria outlined in the new document, which offers guidance to auditors on:

• the presentation of the service organization’s description of its system based on the criteria set forth in DC Section 200, Description Criteria for a Description of a Service Organization’s System in a SOC 2® Report (with Revised Implementation Guidance – 2022) (AICPA, Trust Services Criteria);
• the suitability of the design and operating effectiveness of its controls stated in the description to provide reasonable assurance that service commitments and system requirements were achieved based on trust services criteria relevant to security and availability, set forth in TSP Section 100, 2017 Trust Services Criteria, for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Trust Services Criteria); and
• the implementation of the controls stated in the description to meet the control specifications set forth in the CSA CCM framework.

The CSA STAR Registry is a publicly accessible registry of more than 2,000 providers that documents the security and privacy controls provided by popular cloud computing offerings. STAR encompasses the key principles of transparency, rigorous auditing, and harmonization of standards outlined in the Cloud Control Matrix (CCM), which is composed of 197 control objectives structured in 17 domains, covering all key aspects of the cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain. The controls framework is aligned to the CSA Security Guidance for Cloud Computing and is considered a de facto standard for cloud security assurance and compliance.

Publishing to the registry allows organizations to show current and potential customers their security and compliance posture, including the regulations, standards, and frameworks to which they adhere. It ultimately reduces complexity and helps alleviate the need to fill out multiple customer questionnaires. There are multiple levels of assurance for companies that submit to the STAR Registry, each with a different set of requirements. Accredited STAR certification bodies perform rigorous, independent security assessments of CSPs seeking to achieve STAR Level 2 certification.

• Level 1: Self Assessment: Organizations can submit one or both security and privacy self-assessments. For the security assessment, organizations use the CCM to evaluate and document their security controls, whereas the privacy assessment is based on the GDPR Code of Conduct.
• Level 2: Third-Party Audit. Level 2 of STAR allows organizations to build off of other industry certifications and standards to make them specific for the cloud. Third-party audits are ideal for companies operating in a medium- to high-risk environment or that are in search of a cost-effective way to increase assurance for cloud security and privacy.

Download the report today.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.