ICS (now TechMD) understands the value of our client’s data to their reputation and future success. Because of this, ICS is proud to announce that it has achieved Service Organization Control (SOC) 2 Type II certification standard. SOC 2 compliance helps provide cybersecurity assurances to professional services firms and other companies that are working with an MSP.
Following an audit, based on a rigorous set of services criteria, by Kovalev & Yuen CPAs, LLP, it was confirmed that ICS is a trustworthy and transparent business that takes security and availability seriously. Developed by the Auditing Standards Board of the American Institute of CPAs (AICPA), SOC 2 defines criteria for managing customer data based on security, availability, processing, integrity, confidentiality, and privacy.
Achievement of the SOC 2 Type II certification confirms a deep commitment by ICS, to its partners and clients, about data security and data confidentiality. Underpinning the procedures in place to meet all related criteria are benefits to our community to focus on their respective businesses.
“For organizations considering a managed IT service provider, proceeding with one that has achieved SOC 2 compliance is a minimal requirement,” said Travis Hayes, CIO at ICS.
Maintaining SOC 2 Type II compliance keeps ICS focused on our processes and controls to make sure that we practice what we preach. ICS views itself as a caretaker of our client’s data, which is why trust is at the core of this security certification.
Travis Hayes
What does SOC 2 certification entail?
The SOC 2 certification is awarded to businesses by outside auditors upon assessing the extent to which they comply with one or more of these five trust principles:
Security
The security principle refers to the protection of system resources against unauthorized access. Access controls help prevent potential system abuse, theft or unauthorized removal of data, misuse of the software, and improper alteration or disclosure of information.
Availability
The principle checks the accessibility of the system, products, or services as stipulated by a contract or service level agreement (SLA). It involves security-related criteria that may affect availability. Monitoring network performance and availability, site failover, and security incident handling are critical in this context.
Processing integrity
This principle addresses if a system achieves its purpose, i.e., delivers the right data at the right price at the right time. The data processing must be complete, valid, accurate, timely, and authorized.
However, processing integrity doesn’t only imply data integrity; it also includes the monitoring of data processing, along with quality assurance procedures.
Confidentiality
Information that is designated as confidential should be protected according to the User Entity’s needs. Data is considered confidential if its access and disclosure are restricted to a specified set of persons or organizations.
The principle includes encryption, which is an important control for protecting confidentiality during transmission. Network and application firewalls, along with rigorous access controls, can be used to safeguard information being processed or stored on computer systems.
Privacy
The privacy principle addresses the system’s collection, use, retention, disclosure, and disposal of personal information in conformity with an organization’s privacy notice, as well as with criteria determined by the AICPA’s Generally Accepted Privacy Principles (GAPP).
It includes protecting the unauthorized access of personally identifiable information (PII) – personal data related to health, race, sexuality, and religion is also considered sensitive and generally requires an extra level of protection.
Why is SOC 2 compliance important?
Meeting SOC 2 compliance means establishing processes and practices that guarantee oversight across a company, guaranteeing customers that their data is protected from any unusual, unauthorized, or suspicious activity.
To ensure businesses meet SOC 2 requirements, you need to receive alerts whenever unauthorized access to customer data occurs. SOC 2 compliant companies are required to set up alerts for:
- Exposure or modification of data, controls, configurations
- File transfer activities
- Privileged filesystem, account, or login access
Having a SOC 2 badge on our website represents our dedication to keeping our client’s data private and secure. ICS understands the need for clients to feel safe about their data, and it’s the reason why we are thrilled to feature this badge:
