What is the difference between SOX and SOC in cybersecurity audits?

Key takeaways

• SOX is a law for public companies; SOC is a report framework for service organisations.
• SOC 1 covers controls relevant to customers' financial reporting; SOC 2 covers security, availability, processing integrity, confidentiality and privacy.
• Type I looks at design at a point in time; Type II tests operation over a period.
• A company's SOX auditors often review a vendor's SOC 1 Type II report.
• Indian companies meet SOX if they are US-listed or subsidiaries of US-listed firms.

What is the main difference?

SOX is a law. SOC is a type of audit report. Asking which one to choose is like asking whether to choose a legal requirement or a certificate. They connect, but they are not substitutes.

Read more about the SOC reports at the AICPA and CIMA site.

What does SOX require?

Companies covered by SOX must maintain internal controls over financial reporting and have management assess and report on them. Section 404 is the best-known part, and Section 302 requires senior executives to certify financial reports. For IT, that means controls over systems that affect financial data: access management, change management, backup and operations. Indian companies are in scope if they are listed in the US or are subsidiaries of US-listed groups.

What are SOC 1, SOC 2 and SOC 3?

• SOC 1 reports on controls at a service organisation that are relevant to its customers' financial reporting.
• SOC 2 reports on controls related to the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
• SOC 3 is a shorter, public summary of a SOC 2 style report.

What are Type I and Type II?

• Type I describes the controls and whether they were suitably designed at a single date.
• Type II also tests whether the controls operated effectively over a period, such as several months. Customers usually trust Type II more.

How do SOX and SOC connect? A worked example

A listed company outsources payroll to a cloud provider. Payroll affects financial statements, so it is relevant to SOX. The company's auditors need assurance that the provider's controls work, such as who can change pay data and how changes are approved.

1. The provider commissions an auditor to prepare a SOC 1 Type II report.
2. The company reads the report, checks that the period and scope cover what it uses, and reviews any exceptions.
3. The company also checks its own complementary user entity controls, the tasks the report says the customer must perform.
4. The company's SOX auditors use the report as evidence about the provider's controls.

If the provider also handles confidential employee data, customers might ask for a SOC 2 report as well.

Which should a cybersecurity professional know?

Both. SOX influences IT general controls in listed companies. SOC 2 is common in vendor assessments for SaaS and cloud providers. Auditors and GRC professionals work with both. See what GRC experts do and our CISA course.

Common mistakes

• Treating a SOC 2 report as a certification. It is an auditor's opinion with a defined scope and period.
• Not reading the exceptions and the scope.
• Assuming SOC 2 covers SOX needs. SOC 1 is the relevant one for financial reporting.

Compliance and cloud

For vendor assessment questions, see cloud compliance interview questions.

Next steps

If you are heading into audit and GRC, look at the CISA course and the CISM course. For roles in this area, read what a GRC expert does.

Related reading

• Cybersecurity Jobs for Non-Technical Graduates | Career Opportunities, Skills, and How to Get Started