SOC 2 za male kompanije: Vodič za sertifikaciju bez bola

Šta je SOC 2?

SOC 2 (Service Organization Control 2) je standard revizije koji je razvio AICPA (American Institute of Certified Public Accountants). Evaluira organizacije na osnovu pet "Trust Services Criteria": Security, Availability, Processing Integrity, Confidentiality i Privacy.

Za razliku od ISO 27001 koji je globalni standard, SOC 2 je posebno relevantan na tržištu SAD-a i često ga zahtevaju američki enterprise klijenti, SaaS kompanije i kompanije iz finansijskog sektora širom sveta.

Type I vs Type II

• SOC 2 Type I: Revizor procenjuje da li su kontrole na mestu u određenom trenutku (snapshot). Brže i jeftinije. Dokazuje dizajn sistema.
• SOC 2 Type II: Revizor procenjuje da li su kontrole efektivno funkcionisale tokom perioda od 6-12 meseci. Znatno vredniji za kupce jer dokazuje operativnu efikasnost, ne samo papirni dizajn.

Većina enterprise kupaca traži Type II. Dobra vest: možete početi sa Type I kao prvi korak i preći na Type II godinu dana kasnije.

Pet Trust Services Criteria

• Security (obavezan): Zaštita sistema od neautorizovanog pristupa - MFA, šifrovanje, vulnerability management
• Availability: Sistem je dostupan u dogovorenom roku - uptime monitoring, DR plan, SLA
• Processing Integrity: Obrada podataka je kompletna, tačna i pravovremena
• Confidentiality: Poverljivi podaci su zaštićeni
• Privacy: Lični podaci se prikupljaju, koriste i čuvaju u skladu sa privacy politikom

Koliko košta SOC 2?

• Revizor (CPA firma): $20.000-$80.000 za Type II, zavisno od veličine organizacije i broja Trust Criteria
• Compliance softver (Vanta, Drata, Secureframe): $10.000-$30.000 godišnje - drastično ubrzava pripremu
• Interna priprema: Vreme security tima - 200-500 sati za malu kompaniju
• Pentest: $5.000-$20.000 (revizori često zahtevaju godišnji pentest)

Vremenski okvir

1. Priprema (3-6 meseci): Gap analiza, uspostavljanje politika i kontrola, training zaposlenih
2. Period posmatranja (6-12 meseci): Revizor posmatra kako kontrole funkcionišu u praksi (Type II)
3. Revizija (1-2 meseca): Revizor pregledava evidenciju, intervjuiše zaposlene
4. Izveštaj: Dobijate SOC 2 izveštaj koji delite sa klijentima

Šta revizor proverava

• Politike bezbednosti informacija (information security policy)
• Access control - ko ima pristup čemu, review privilegija
• Change management - kako se upravljaju promene u kodu i infrastrukturi
• Incident response - kako reagujete na bezbednosne incidente
• Vulnerability management - redovni scans, patch management
• Vendor management - bezbednost trećih strana
• HR procesi - onboarding/offboarding, background checks
• Business continuity / Disaster recovery plan

Kako početi

Pre angažmana revizora, uradite internu gap analizu: koliko od zahtevanih kontrola već imate? Vulnerability assessment je često jedna od prvih stavki na listi - alati poput Shieldome Scout mogu biti dokaz kontinuiranog vulnerability scanning programa.

What Is SOC 2?

SOC 2 (Service Organization Control 2) is an auditing standard developed by AICPA (American Institute of Certified Public Accountants). It evaluates organizations based on five "Trust Services Criteria": Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Type I vs Type II

• SOC 2 Type I: The auditor assesses whether controls are in place at a specific point in time (snapshot). Faster and cheaper. Proves system design.
• SOC 2 Type II: The auditor assesses whether controls were effectively operating during a 6-12 month period. Much more valuable for customers as it proves operational effectiveness, not just paper design.

How Much Does SOC 2 Cost?

• Auditor (CPA firm): $20,000-$80,000 for Type II, depending on organization size
• Compliance software (Vanta, Drata, Secureframe): $10,000-$30,000 annually
• Internal preparation: Security team time - 200-500 hours for a small company
• Penetration test: $5,000-$20,000 (auditors often require annual pentests)

What Auditors Check

• Information security policies
• Access control - who has access to what, privilege reviews
• Change management - how changes in code and infrastructure are managed
• Incident response - how you respond to security incidents
• Vulnerability management - regular scans, patch management
• Vendor management - third-party security
• HR processes - onboarding/offboarding, background checks
• Business continuity / Disaster recovery plan

How to Get Started

Before engaging an auditor, conduct an internal gap analysis: how many of the required controls do you already have? Vulnerability assessment is often one of the first items on the list - tools like Shieldome Scout can serve as evidence of a continuous vulnerability scanning program.