Fastpath has completed their SOC 1 Type 2 examination.
Let’s talk about SOC’s and why they matter. Not socks, though they keep you warm. Not SOX in white or red, though they can be fun to watch, but SOCs.
A SOC (service organization control) is an attestation standard, a form of an audit. It means that if you use cloud services, your auditors may rely on the cloud provider’s SOC to reduce their work. It also means that a cloud provider has been deliberate about their controls and those controls have been audited to ensure appropriate operation. Like you, Fastpath has 2 SOCs cleverly known as a SOC 1 and a SOC 2. They break down like this:
- SOC 1: Internal Controls over Financial Reporting (ICFR).
- SOC 2: Controls at a service organization that are relevant to security, availability, processing integrity confidentiality, or privacy.
[https://socreports.com/audit-overview/soc-1-vs-soc-2]
If your cloud provider doesn’t have at least a SOC 2, you’ve got problems. A SOC 2 is tied to control over the provider’s data. Without that, you have to wonder about what kind of protection is in place. A SOC 2 is relevant for any cloud provider. A SOC 1 is appropriate if that cloud provider is also tied to Financial Reporting.
But there is also more than one type of each SOC. A type 1 indicates that the company has set up controls and the design of the controls have been reviewed. A type 2 indicates that the controls have been in place for a period of time and then been audited. You can’t get a type 2 overnight.
Fastpath has BOTH a SOC 1 Type 2 and a SOC 2 Type 2. These reports aren’t always publicized, so if you’re unsure, ask your cloud providers. If you get dumb looks and blank stares, be very nervous.