The AICPA Trust Services Criteria is broader and less prescriptive than other, more cybersecurity-focused frameworks, providing you with maximum flexibility to define which governance, technical, physical and process controls to implement and to what extent, to fulfill the control objectives within the framework.
Our methodology will help you confirm that this framework is the most beneficial for your organization to utilize for SOC 2 certification and to:
- Determine the scope of control, which includes the people, processes, technologies, locations, data, etc. that will be in scope and subject to the controls in question.
- Perform a gap assessment against the projected scope of control to determine which supporting controls are already in place and identify which SOC 2 criteria will require new or enhanced controls.
- Develop, resource and execute a gap remediation plan to successfully implement and/or enhance needed controls so that they are provably effective over time. Resourcing must include long-term capital and operational expenditures to ensure the long-term effectiveness and provability of the controls.
- Operate the environment and in-scope controls over a period of time, generating the evidence required along the way proving that the controls have been continuously in place and effective
