SOC 2 Readiness: Od gap analize do sertifikacije

← Blog

Zašto SOC 2 postaje uslov za prodaju enterprise klijentima

SOC 2 (Service Organization Control 2) je revizorski standard koji su razvili AICPA (Američki institut CPA). Nije zakon — ali je de facto uslov za svaku SaaS, cloud ili IT kompaniju koja želi da posluje sa enterprise klijentima u SAD, Kanadi i sve više u Evropi.

Tipičan scenario: potencijalni klijent pošalje security questionnaire, a u njemu piše "Da li imate SOC 2 izveštaj?" Bez njega, mala SaaS firma ne može ni ući u procurement proces kod Fortune 500 kompanija.

Type I vs Type II — Ključna razlika

SOC 2 Type I je snimak stanja: revizor potvrđuje da u određenom trenutku vaši kontrole postoje i da su adekvatno dizajnirane. Brže i jeftinije, ali manje vrednosti za ozbiljne kupce.

SOC 2 Type II pokriva period od minimum 6 meseci i potvrđuje da kontrole ne samo postoje već i funkcionišu efektivno tokom vremena. Ovo je standard koji enterprise klijenti zahtevaju. Proveravaju se logovi, incidenti, promene — sve što je stvarno radilo.

5 Trust Services Criteria

SOC 2 se organizuje oko 5 kategorija. Jedino CC (Common Criteria — Security) je obavezno za svaki SOC 2 izveštaj. Ostale dodajete prema relevantnosti za vaš poslovni model.

CC — Security (obavezno)

Fizička i logička zaštita sistema. Pokriva: access control, change management, incident response, risk assessment, monitoring. Svaka SOC 2 sertifikacija mora pokriti ovaj criterion.

A — Availability

Sistem je dostupan kako je dogovoreno. Relevantan za SaaS provajdere sa SLA garantijama. Zahteva: uptime monitoring, disaster recovery, kapacitet planiranje, incident management.

PI — Processing Integrity

Obrada podataka je kompletna, validna, tačna i autorizovana. Kritično za fintech, e-commerce i sisteme koji obrađuju finansijske transakcije ili kritične poslovne podatke.

C — Confidentiality

Podaci označeni kao poverljivi su zaštićeni. Enkripcija u prenosu i mirovanju, NDA sa zaposlenima, kontrole pristupa. Relevantan za svakoga ko rukuje B2B podacima klijenata.

P — Privacy

Lični podaci se prikupljaju, koriste, čuvaju i brišu u skladu sa politikom privatnosti i zakonskim zahtevima. Preklapanje sa GDPR je veliko — ako ste GDPR compliant, Privacy criterion je pola puta.

Šta revizor stvarno proverava (tehnička strana CC)

• CC6.1 — Logical access: Princip minimalnih privilegija, MFA za sve kritične sisteme, godišnji review pristupa
• CC6.6 — Boundary protection: Firewall pravila, network segmentacija, monitoring inbound saobraćaja
• CC6.7 — Transmission security: TLS 1.2+, enkriptovani kanali za sve prenose osetljivih podataka
• CC7.1 — Vulnerability management: Redovni vulnerability scans, patch management proces, pentest jednom godišnje
• CC7.2 — Monitoring: SIEM ili log agregacija, alerting na anomalije, 24/7 monitoring za kritične sisteme
• CC8.1 — Change management: Code review proces, testiranje pre deployment-a, dokumentovane promene
• CC9.2 — Risk assessment: Dokumentovana procena rizika, godišnje ažuriranje

Vremenski okvir i troškovi

Za firmu od 10–50 zaposlenih koja kreće od nule:

• Gap analysis (1–2 meseca): Identifikujete što nedostaje. Ovo je naš compliance readiness servis.
• Remedijacija (3–6 meseci): Implementirate sve kontrole koje nedostaju, dokumentujete sve procedure.
• Observation period (6 meseci, samo za Type II): Kontrole moraju biti aktivne minimum 6 meseci pre Type II revizije.
• Revizija (1–3 meseca): Akreditovani CPA firm sprovodi formalnu reviziju.

Troškovi revizije: €8.000–€25.000 za Type II (zavisno od veličine kompanije i obima). Gap analysis i priprema: €1.500–€5.000. Tools (Vanta, Drata, Secureframe): €10.000–€30.000 godišnje.

Šta možete uraditi sami da ubrzate proces

1. Uradite gap analysis pre nego što angažujete revizora — saznajte gde ste i šta nedostaje
2. Dokumentujte sve što već radite: security policy, access review, incident response plan
3. Implementirajte MFA na svim admin sistemima odmah — to je CC6.1 i ne može čekati
4. Podesite vulnerability scanning — redovni automated scans su deo CC7.1
5. Koristite compliance management tool od početka (Vanta ili sličan) — automatizuju prikupljanje dokaza

← Blog

Why SOC 2 Is Becoming a Sales Requirement for Enterprise Clients

SOC 2 (Service Organization Control 2) is an auditing standard developed by the AICPA (American Institute of CPAs). It's not a law — but it's the de facto requirement for any SaaS, cloud, or IT company that wants to do business with enterprise clients in the US, Canada, and increasingly in Europe.

Typical scenario: a prospective client sends a security questionnaire, and it includes "Do you have a SOC 2 report?" Without one, a small SaaS company can't even enter the procurement process at Fortune 500 companies.

Type I vs Type II — The Key Difference

SOC 2 Type I is a point-in-time snapshot: the auditor confirms that at a specific moment, your controls exist and are appropriately designed. Faster and cheaper, but less valuable to serious buyers.

SOC 2 Type II covers a minimum 6-month period and confirms that controls not only exist but operate effectively over time. This is the standard enterprise clients require. Logs, incidents, changes — everything that actually happened is reviewed.

5 Trust Services Criteria

SOC 2 is organized around 5 categories. Only CC (Common Criteria — Security) is mandatory for every SOC 2 report. Others are added based on your business model's relevance.

CC — Security (mandatory)

Physical and logical system protection. Covers: access control, change management, incident response, risk assessment, monitoring. Every SOC 2 certification must cover this criterion.

A — Availability

The system is available as agreed. Relevant for SaaS providers with SLA guarantees. Requires: uptime monitoring, disaster recovery, capacity planning, incident management.

PI — Processing Integrity

Data processing is complete, valid, accurate, and authorized. Critical for fintech, e-commerce, and systems handling financial transactions or critical business data.

C — Confidentiality

Data designated as confidential is protected. Encryption in transit and at rest, NDAs with employees, access controls. Relevant for anyone handling B2B client data.

P — Privacy

Personal data is collected, used, stored, and deleted in accordance with the privacy policy and legal requirements. Overlap with GDPR is significant — GDPR compliance gets you halfway through the Privacy criterion.

What the Auditor Actually Checks (CC Technical Side)

• CC6.1 — Logical access: Least privilege principle, MFA on all critical systems, annual access review
• CC6.6 — Boundary protection: Firewall rules, network segmentation, monitoring of inbound traffic
• CC6.7 — Transmission security: TLS 1.2+, encrypted channels for all sensitive data transfers
• CC7.1 — Vulnerability management: Regular vulnerability scans, patch management process, annual pentest
• CC7.2 — Monitoring: SIEM or log aggregation, anomaly alerting, 24/7 monitoring for critical systems
• CC8.1 — Change management: Code review process, testing before deployment, documented changes
• CC9.2 — Risk assessment: Documented risk assessment, annual update

Timeline and Costs

For a company of 10–50 employees starting from scratch:

• Gap analysis (1–2 months): Identify what's missing. This is our compliance readiness service.
• Remediation (3–6 months): Implement missing controls, document all procedures.
• Observation period (6 months, Type II only): Controls must be active for at least 6 months before a Type II audit.
• Audit (1–3 months): An accredited CPA firm conducts the formal review.

Audit costs: €8,000–€25,000 for Type II (depending on company size and scope). Gap analysis and preparation: €1,500–€5,000. Compliance tools (Vanta, Drata, Secureframe): €10,000–€30,000 per year.