Servpac Blog

Cloud computing has revolutionized the world of business and data. Now businesses have 24x7x365 access to their data, but this also opens up the possibilities for potential security risks. In the pre-Cloud days, if businesses wanted new software, they would install it on their own local servers - making it easy to control the reliability of their systems and data. This was a timely process and expensive to maintain, so businesses now use third party providers to upload and maintain data in much less time. 

Cloud providers like Servpac now can host your software and data, but this creates some major concerns. Confidential customer information is now in the hands of a third-party provider, so how do they guarantee a safe environment for your business data? The best service providers certify their systems meet the demand for data privacy and confidentiality through SOC 1, SOC 2, and HIPAA compliance. 

SOC Compliance

One of the most effective ways for Cloud service providers to demonstrate their assurance is through SOC reports. Service Organization Control (SOC) reports were first created by the AICPA in 1992 to measure effectiveness of providers’ controls over financial reporting (ICFR). As Cloud computing evolved, AICPA revised their standards to expand beyond financial controls and include security and data confidentiality with their SOC framework.

SOC 1

A SOC 1 report is an examination of internal controls for service providers that handle customer financial data. This helps providers eliminate possible errors in client information and ensuring efficiency in their controls. SOC 1 reports prove to customers their financial information is being handled correctly and within their expectations. This report applies towards payroll, medical claims, loan servicing, and data center companies that handle financial information. There are currently two types of SOC 1 reports.

• SOC 1 Type 1: Type 1 reports addresses the suitability of a service organization’s controls and how they achieve objectives within a specific point of time. The focus is testing the design of the service company’s controls but not the operating effectiveness.
• SOC 1 Type 2: Type 2 reports not only focus on testing the design but also operating effective of internal controls over a period of time such as 1 year. 

SOC 2

SOC 2 is an entirely different report that tests controls at a service provider relevant to security, confidentiality, privacy, and availability of a system. This report focuses on securing customer’s data and making it available to access anytime. This is valuable for data that customers store with a third-party provider.  

SOC 2 reports assure the controls at a service organization meet the framework of the AICPA’s 5 Trust Services Criteria:

1. 1. Security: Protection against unauthorized access, use, or modification

   2. Availability: The system is available for operation and use 

   3. Processing Integrity: System processes data in a complete, accurate, authorized, and timely manner

   4. Confidentiality: Confidential information is protected and disclosed to specific groups.

   5. Privacy: System collects, uses, retains, discloses, and destroys personal information that meets organization’s objectives and privacy guidelines.

This report is intended for tech-based companies such as Cloud providers, data centers, software developers, and IT providers. Just like SOC 1, there are two types of SOC 2 reports:

• SOC 2 Type 1: SOC 2 Type 1 reports tests the implementation and design of a service provider’s controls at a specific point of time.
• SOC 2 Type 2: Type 2 report tests and implementation, design, and operating effectiveness of internal controls based on the Trust Services Criteria over a period of time (usually 1 year). 

HIPAA Compliance

HIPAA stands for Health Insurance Portability and Accountability Act. Established in 1996, HIPAA set the standards for administration of healthcare with one major area being electronic protected health information (ePHI) such as patient test results or appointment dates. HIPAA outlines standards for protecting this electronic data, including network security and management requirements for service providers

HIPAA states that three groups have to comply: covered entities, business associates, and workforce. Service providers are considered business associates of their healthcare and need to comply with HIPAA regulations. They need to ensure the ePHI is confidential, available and protected from unauthorized use or threats. 

SOC and HIPAA compliance are essential for service providers to protect your operations and customer data. It’s more than a requirement or checking a box - it’s the ultimate commitment for creating the best customer experience and making sure their clients’ data and software is in good hands. For more information about SOC and HIPAA compliance, please call 808-237-500 or request a FREE consultation with one of our team members.

--

Servpac is a Hawaii-based telecommunications company providing innovative and integrated data center colocation, fiber internet, local cloud, business VoIP, and managed network solutions for businesses. The company is the largest local CLEC (competitive local exchange carrier) in the state and provides 24x7x365 support for businesses to help them compete in the global marketplace.