Digital Innovation Starts with a Digital Core

Digital Innovation A lot of times when the prevalent industry trends are discussed among industry folks, there are usually two directions in which the conversation goes. It is either varying states of disbelief at the rate of change within the…

Better Data Risk Mitigation For SaaS Providers

Better Data Risk Mitigation for SaaS Providers


We live in a world that is rife with internal-controls breakdowns that result in security and data breaches, which can cause tremendous business and reputational damage for organizations.

The rise of cloud computing systems has now created an even greater need for organizations to develop the right controls to protect data that reside in the ‘cloud.’ Virtually every organization leverages Software-as-a-Service (SaaS) solutions – where data can be easily accessed through a web browser.

As most technology providers are migrating away from larger enterprise data systems to the cloud, it opens the doors to vulnerabilities. With SaaS providers hosting vital client data, they need to provide the right level of assurance that their clients’ sensitive data resides in a highly trusted environment.

Created by the American Institute of Certified Public Accountants (AICPA), Service Organization Control 2 (SOC 2) reporting allows any SaaS provider to mitigate risk when it comes to managing sensitive customer data in a virtualized environment.

Going through a SOC 2 security audit and receiving a favorable report allows SaaS providers to build-in a level of controls and trust in relationships with clients. However, the challenge with SOC 2 reporting is that many SaaS providers are unaware of this reporting and that not having an audit completed can cause significant business damage.

In addition, it is often the SaaS providers’ clients who inquire about SOC 2 reporting, and an “I don’t know” response does not provide clients with the critical assurance that they seek.

Fortunately, there are new tools that help SaaS providers determine their readiness to undergo a SOC 2 security audit and gain a ‘clean opinion.’

As more organizations are seeking support from SaaS providers, we will continue to see the true value of cloud computing emerge for any business sector. Providing the right level of assurance is critical for SaaS providers to further grow their businesses, and the little secret of undergoing a SOC 2 audit is now out of the bag.

Now, is the time to make sure that all of your clients’ data is residing in a truly trusted environment, and there are solutions for meeting this goal.

By Paul L. Shifrin, CPA, is a Director of Audit Services at SC&H Group

Paul directs SC&H’s SOC/SSAE 16 auditing practice, providing companies with audit services for their outsourcing of key components of their clients’ internal controls.

(Image Source: Shutterstock)


Established in 2009, CloudTweaks is recognized as one of the leading authorities in cloud connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as technology related infographics and comics.