FAQs
Have Questions?
Does my Houston business need SOC 2?
No law requires SOC 2. It becomes necessary when a customer or prospect asks for the report, usually through a vendor-risk questionnaire or a contract renewal. Houston software, IT services and data-handling firms that sell to larger companies meet it most often. If nobody has asked, a framework such as NIST CSF may be the better starting point.
Can CinchOps issue our SOC 2 report?
No. Only an independent CPA firm can issue a SOC 2 report. CinchOps runs the IT controls that auditor tests, such as access reviews, patching, monitoring and backups, and collects the evidence. Be cautious of any IT provider that says it can make you SOC 2 compliant on its own.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report describes your controls and gives the auditor's opinion on their design at a point in time. A Type 2 report also tests whether those controls operated effectively over a period. Larger customers usually ask for Type 2, because it shows the controls were followed and not only written down.
Which trust services categories do we need?
A SOC 2 report covers one or more of 5 trust services categories: security, availability, processing integrity, confidentiality and privacy. Security is the baseline in every report. The others are added when your customers or your service call for them. CinchOps helps you match the scope to what your customer asked for.
Do you work with our auditor?
Yes. Your auditor sets what has to be shown, and CinchOps supplies the technical side: how each control is configured, the reports that show it running, and answers to follow-up questions. A named engineer handles those requests through the audit period.
