| SOC 2 Certification Explained: Insights From Our Latest Audit |

We’ve just renewed our SOC 2 certification and this year we even added a new app to the scope. A great opportunity to talk to Luka, who is responsible for SOC 2 compliance at codefortynine. In this interview, Luka shares what SOC 2 is all about, why it matters for our customers, and what it’s really like to go through the audit process every year.

Q: Luka, what exactly is SOC 2, and why is it relevant for software companies like ours?

SOC 2 is a standard defined by the AICPA for a whole organization and audited by third-parties. For us at codefortynine it’s a trust signal. It shows that we are continously investing in the security of our apps and are willing to let our procedures be audited.

A SOC 2 Type II examination is an attestation engagement, under AICPA professional standards, in which a service organization’s management asserts that its system description is fairly presented and its controls (to meet selected Trust Services Criteria) are suitably designed and operating effectively over a specified period of time. The service auditor then examines and reports on both the design and operational effectiveness of those controls.

Source: AICPA – SOC 2® Reporting on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (AICPA, 2018 with 2022 updates).

Q: Why did we decide to do SOC 2 in the first place, and why do we keep renewing it year after year?

While there are lots of different standards that can be provided as a trust signal we tried to choose a well respected and broadly accepted standard. We also considered ISO/IEC 27001, but that standard is mostly relevant in the EU and DACH area, and most of our customers are based in North America, where SOC 2 enjoys wider recognition.

SOC 2 certification is supposed to show an ongoing commitment to the standards being tested. Each report produced by an auditor is usually only valid for a year and with the end of the last audit period the next audit period begins. A single SOC 2 report is nice to have but the real trust signal comes from ongoing audits each year.

Q: This year we added a new app to the scope, what exactly does that mean?

This year we aquired our longstanding partner ToLab and integrated their apps in our processes. This includes the SOC 2 audit. We want to signal our customers that all of our apps are meeting the same high security standards. In practice this meant including the CI CD infrastructure for our ‘new’ apps into Vanta and applying all our development practices with the new apps.

Q: What challenges did you personally face in this process?

I’m no compliance expert by trait or training, so the first time it was a lot of research. Finding the most efficient way to go through a SOC 2 audit, especially the first one, was a long process. This very clear guide helped me enormously and was a good starting point for further research.

Now, after doing it for the third time I’m rather confident going into our renewals, but sometimes an auditor can throw you a curveball.

Q: Are there any lessons learned from the process that you would approach differently next time?

A SOC 2 audit is a team game. Usually, there are additional evidence requests by auditors during the audit. Unfortunately this year the end of our observation period and therefore the end of our audit fell in the summer holiday season. This made gathering all requested evidence from the responsible people a bit more stressful than necessary. We already have extended our observation period to avoid this problem next year.

Q: SOC 2 sounds very technical and formal, how many people in the team are actually involved?

On some level the whole team is involved. Every employee and external contractor has to comply with our policies which are one of the core rules we are tested against. Our auditor tries to measure how good we are at actually following through and complying with these policies.

Q: How does the collaboration with the auditors work, is it more relaxed or sometimes stressful?

The real audit begins towards the end of the observation period. Usually one year after the end of the last observation period. This means the auditor checks everything we collected and tracked over the previous year and will request clarification or additional evidence. Every year there will be a new team of auditors looking at the evidence. This means sometimes company or industry specific things need to be explained every year and every team of auditors has specific focuses and preferences when it comes to how and what evidence has to be provided. This can cause some stress especially if you don’t want to extent the observation period to allow more time for collecting evidence.

Q: How do you explain what SOC 2 means to colleagues who are not directly involved?

When we started we spent a lot of time explaining it to our colleagues, but for new colleagues its just part of our onboarding and embedded in our daily processes. We try to communicate clearly that this whole process is an important trust signal for our customers.

Q: What does the renewed certification mean for our customers?

It means codefortynine is continuing to invest in the security of our products and is committed to doing this in the future.

Also, if you need an up-to-date SOC 2 report for your vendor review check out our Trust Center.

Q: Is there a moment or a little anecdote from this year’s audit that has particularly stuck in your mind?

A moment that stuck with me from this year’s audit? Vanta sent over some really cool socks. Such a fun little surprise after all the hard work.