SOC 2 za male kompanije: Vodič za sertifikaciju bez bola

Šta je SOC 2?

SOC 2 (Service Organization Control 2) je standard revizije koji je razvio AICPA (American Institute of Certified Public Accountants). Evaluira organizacije na osnovu pet "Trust Services Criteria": Security, Availability, Processing Integrity, Confidentiality i Privacy.

Za razliku od ISO 27001 koji je globalni standard, SOC 2 je posebno relevantan na tržištu SAD-a i često ga zahtevaju američki enterprise klijenti, SaaS kompanije i kompanije iz finansijskog sektora širom sveta.

Type I vs Type II

• SOC 2 Type I: Revizor procenjuje da li su kontrole na mestu u određenom trenutku (snapshot). Brže i jeftinije. Dokazuje dizajn sistema.
• SOC 2 Type II: Revizor procenjuje da li su kontrole efektivno funkcionisale tokom perioda od 6–12 meseci. Znatno vredniji za kupce jer dokazuje operativnu efikasnost, ne samo papirni dizajn.

Većina enterprise kupaca traži Type II. Dobra vest: možete početi sa Type I kao prvi korak i preći na Type II godinu dana kasnije.

Pet Trust Services Criteria

• Security (obavezan): Zaštita sistema od neautorizovanog pristupa — MFA, šifrovanje, vulnerability management
• Availability: Sistem je dostupan u dogovorenom roku — uptime monitoring, DR plan, SLA
• Processing Integrity: Obrada podataka je kompletna, tačna i pravovremena
• Confidentiality: Poverljivi podaci su zaštićeni
• Privacy: Lični podaci se prikupljaju, koriste i čuvaju u skladu sa privacy politikom

Koliko košta SOC 2?

• Revizor (CPA firma): $20.000–$80.000 za Type II, zavisno od veličine organizacije i broja Trust Criteria
• Compliance softver (Vanta, Drata, Secureframe): $10.000–$30.000 godišnje — drastično ubrzava pripremu
• Interna priprema: Vreme security tima — 200–500 sati za malu kompaniju
• Pentest: $5.000–$20.000 (revizori često zahtevaju godišnji pentest)

Vremenski okvir

1. Priprema (3–6 meseci): Gap analiza, uspostavljanje politika i kontrola, training zaposlenih
2. Period posmatranja (6–12 meseci): Revizor posmatra kako kontrole funkcionišu u praksi (Type II)
3. Revizija (1–2 meseca): Revizor pregledava evidenciju, intervjuiše zaposlene
4. Izveštaj: Dobijate SOC 2 izveštaj koji delite sa klijentima

Šta revizor proverava

• Politike bezbednosti informacija (information security policy)
• Access control — ko ima pristup čemu, review privilegija
• Change management — kako se upravljaju promene u kodu i infrastrukturi
• Incident response — kako reagujete na bezbednosne incidente
• Vulnerability management — redovni scans, patch management
• Vendor management — bezbednost trećih strana
• HR procesi — onboarding/offboarding, background checks
• Business continuity / Disaster recovery plan

Kako početi

Pre angažmana revizora, uradite internu gap analizu: koliko od zahtevanih kontrola već imate? Vulnerability assessment je često jedna od prvih stavki na listi — alati poput Shieldome Scout mogu biti dokaz kontinuiranog vulnerability scanning programa.

What Is SOC 2?

SOC 2 (Service Organization Control 2) is an auditing standard developed by AICPA (American Institute of Certified Public Accountants). It evaluates organizations based on five "Trust Services Criteria": Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Type I vs Type II

• SOC 2 Type I: The auditor assesses whether controls are in place at a specific point in time (snapshot). Faster and cheaper. Proves system design.
• SOC 2 Type II: The auditor assesses whether controls were effectively operating during a 6–12 month period. Much more valuable for customers as it proves operational effectiveness, not just paper design.

How Much Does SOC 2 Cost?

• Auditor (CPA firm): $20,000–$80,000 for Type II, depending on organization size
• Compliance software (Vanta, Drata, Secureframe): $10,000–$30,000 annually
• Internal preparation: Security team time — 200–500 hours for a small company
• Penetration test: $5,000–$20,000 (auditors often require annual pentests)

What Auditors Check

• Information security policies
• Access control — who has access to what, privilege reviews
• Change management — how changes in code and infrastructure are managed
• Incident response — how you respond to security incidents
• Vulnerability management — regular scans, patch management
• Vendor management — third-party security
• HR processes — onboarding/offboarding, background checks
• Business continuity / Disaster recovery plan

How to Get Started

Before engaging an auditor, conduct an internal gap analysis: how many of the required controls do you already have? Vulnerability assessment is often one of the first items on the list — tools like Shieldome Scout can serve as evidence of a continuous vulnerability scanning program.