RSI Security

What is SOC 2 Common Criteria Mapping?

RSI Security
Vulnerability Management Lifecycle

To help service organizations assure their clients of data safety, the American Institute of Certified Public Accountants (AICPA) has developed several System and Organization Controls (SOC) audits. There are three variations, but SOC 2 is the most common for evaluating whether a company’s security practices are up to par. Another critical component of SOC 2 reporting is the SOC 2 common criteria mapping, which facilitates all compliance.

 

What is SOC 2 Common Criteria Mapping?

Regulatory compliance is one of the most essential areas of cybersecurity, and companies need to ensure they adhere to all applicable requirements—potentially across multiple standards. AICPA provides guidance that maps SOC 2 trust services criteria onto several other frameworks, including:

Understanding the relationships between SOC 2 and these frameworks simplifies the SOC 2 common criteria and supplemental criteria, as you’ll know what is being mapped and how to meet all requirements. It’s also important to note that SOC 2 audits follow the Trust Services Criteria (TSC). Therefore, SOC 2 common criteria refers to the TSC specifications used when conducting a SOC 2 audit.

 

SOC 2 Common Criteria Mapping to ISO 27001

The first framework AICPA maps the SOC 2 criteria onto is ISO/IEC 27001 – Information Security Management. This international standard is widely used outside the US, and any company with a global network of clients should consider ISO 27001 compliance. Its core comprises ten clauses and an Annex that breaks down into 114 controls across 14 groups:

AICPA’s ISO 27001 mapping spreadsheet charts overlap between these controls and the Trust Services Criteria.

 

Download Our Free SOC 2 Compliance Checklist

 

SOC 2 Common Criteria Mapping to NIST CSF

Another widely applicable framework that the TSC maps onto neatly is the Cybersecurity Framework (CSF), published by the National Institute for Standards and Technology (NIST). NIST’s CSF is a comprehensive guide that stipulates protections and best practices for all enterprises and provides the foundation for many other frameworks used by the US government.

At the core of the NIST CSF are five Functions, which break down into 23 Categories:

Each Category breaks down further into subcategories, many of which are based on other frameworks’ controls. AICPA’s NIST CSF mapping spreadsheet maps the TSC across these.

SOC 2 Common Criteria Mapping to COBIT 5

Another prominent cybersecurity framework AICPA maps the SOC 2 common criteria onto is ISACA’s Control Objectives for Information and Related Technologies (COBIT). In particular, the AICPA COBIT mapping spreadsheet maps the TSC onto COBIT 5’s 37 Processes. The Processes are distributed across five Domains, which fall under two categories. The breakdown is as follows:

Critically, COBIT 5 (2012) is currently out-of-date, superseded by COBIT 2019. Still, AIPCA includes it within its dedicated mapping resources. Per ISACA’s comparison of the two COBIT versions, the latter is based upon a six-principle core rather than COBIT 5’s five principles. But both versions share the Domain scheme, with three additional Processes present in COBIT 2019. Mapping SOC 2 onto COBIT 2019 is thus straightforward.

 

SOC 2 Common Criteria Mapping to NIST 800-53

The CSF isn’t the only NIST framework onto which AICPA maps SOC 2 trust services criteria. It also provides the NIST SP 800-53 mapping spreadsheet to cover the common ground between SOC 2 and Special Publication (SP) 800-53: Security and Privacy Controls for Information Systems and Organizations. SP 800-53 comprises over 300 Controls across 20 Families:

These SP 800-53 Controls are also dynamic. Each breaks down into several sub-controls, totaling over 1000—and all are often updated to account for evolving cybersecurity threats.

SOC 2 Common Criteria Mapping to EU GDPR

Finally, AICPA also maps the SOC 2 onto the European Union (EU) General Data Protection Regulation (GDPR) in its EU GDPR mapping spreadsheet. The EU GDPR exists to protect the personal data rights of EU citizens and applies unilaterally to all companies that come in contact with protected individuals’ data. It’s massive in scale, with 99 articles across 11 Chapters.

The most critical elements of the EU GDPR break down across its second and third chapters:

Most of these elements map directly onto the TSC, per AICPA’s spreadsheet. All GDPR Articles are accounted for, with indicators of gaps between the two frameworks, given GDPR’s scope.

 

What Are the SOC 2 Common Criteria?

The criteria that AICPA has mapped across all of the above frameworks come from the Trust Services Criteria (TSC) framework used to conduct SOC 1, 2, and 3 audits. The common criteria (CC Series) apply across all five TSC categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

There are nine CC Series subcategories:

The CC subcategories are based on principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. Four TSC categories also have supplemental criteria (Series A, PI, C, and P, respectively designated by the category-matching initial) while remaining subject to the CC Series. The Security category does not have specific supplemental criteria outside those specified in the CC Series.

 

Professional SOC 2 Compliance Services

If your company is currently preparing for a SOC 2 audit and report, RSI Security’s SOC 2 compliance services offer robust implementation and assessment advisory. Our comprehensive regulatory compliance services suite adds on mapping for SOC 2 common criteria for all frameworks detailed above, along with any other your company may need to follow.

To get started with mapping and meeting all your requirements, contact RSI Security today!

 

Request a Free Consultation

 

 

Exit mobile version