SOC 2 compliance

The Service Organization Controls 2 (SOC 2) is a highly-desired certification for any organization that delivers services, including SaaS-delivered solutions. The certification attests that an organization has implemented security controls in line with one or more of the following principles: security, availability, processing integrity, confidentiality, and privacy.

Many IT security teams find it difficult to successfully implement the many IT security controls required to comply with the SOC 2 Security Principle. Procuring each technology can be costly, and then successfully deploying, configuring, and then performing the daily management and monitoring of all the security controls can overwhelm even large security teams. This results in SOC 2 certification being out of reach for many organizations or a very long road (and time) to satisfy each of the Common Criteria.

Unified Security Management™ (USM) is a SOC 2 certified solution that helps you check many of the SOC 2 compliance requirements off your list as you work towards your next SOC 2 audit. In one affordable, easy-to-use solution, USM combines the essential security controls you need to demonstrate compliance, including asset discovery, vulnerability assessment, log management, file integrity monitoring, and others. It also provides predefined compliance reports out of the box and automatic threat intelligence updates, helping you to stay in compliance with continuous security monitoring.

Unlike the effort to deploy and manage multiple other security controls solutions, it can take as little as one day to fully deploy the USM platform for compliance management. You can centralize monitoring of all your on-premises, AWS or Azure cloud, and cloud applications, helping you to satisfy the common criteria required for SOC 2 compliance faster and ensure continuous security and compliance monitoring of all your environments. In addition to SOC 2, the USM platform is also certified as PCI DSS and HIPAA compliant, giving you the assurance you need in a security monitoring platform for cloud, on-premises, and hybrid environments.

USM delivers multiple SOC 2 compliance must-have security essentials in one unified solution, to help you to prepare for your next SOC 2 audit faster and more easily.

• Asset Discovery and Inventory
• Vulnerability Assessment
• Threat and Intrusion Detection (IDS) across host, network, and cloud environments
• File Integrity Monitoring (FIM)
• Orchestrated Incident Response
• Log Management
• Security & Compliance Reports & Views
• Integrated Threat Intelligence

The USM platform delivers all of the following essential security capabilities in one unified solution for security and compliance management.

Asset Discovery & Inventory

Understanding what physical and virtual assets exist across your on-premises and cloud environments (including Azure, AWS, VMware and Hyper-V) is the first step to understanding your risk and is recommended to achieve compliance with Common Criteria Controls 3.2 and 4.1 of the SOC 2 Security Principle. The USM platform automatically discovers and inventories all your critical on-premises and cloud assets. You can define custom asset groups that you can use to run vulnerability scans and reports.

Vulnerability Assessment

The ability to run quarterly (or more) vulnerability assessments is called out across Common Criteria Controls 3.2, 4.1, 5.8, 6.1 and 7.3 of the SOC 2 Security Principle. The USM platform provides internal compliance vulnerability scan capabilities, so you can readily and regularly detect vulnerabilities as part of your compliance and security program.

Threat Detection

Knowing the presence of threats across your infrastructure is a requirement across several Common Criteria Controls. takes a multi-layered approach to intrusion detection, providing out-of-the-box network intrusion detection (NIDS), host intrusion detection (HIDS), and cloud intrusion detection. Advanced event correlation compares anomalies and detected threats against the known state of your environment to generate relevant alarms while reducing false positives.

File Integrity Monitoring

File Integrity Monitoring is a best practice control to identify changes that are unauthorized or that may introduce vulnerabilities and risk to your organization. FIM is a best practice to meet Common Criteria Controls CC5.1, CC6.1, and CC7.4. As part of its host-intrusion detection system, the USM platform includes file integrity monitoring (FIM) capabilities that can monitor changes to files, directories, and the Windows Registry.

Orchestrated Incident Response

With cybersecurity, time is not on your side, and with the proliferation of single-point security solutions in the marketplace today, it’s no surprise that IT teams struggle to efficiently monitor the security of their environments and to effectively respond to incidents. The need for an efficient incident response process is outlined in Common Criteria controls CC3.2, CC5.4 and CC6.2 to expedite the mitigation of identified threats and risks to your organization. The USM platform integrates orchestrated security response across both internal and external IT security and management tools, such as isolating a system infected by malware from the network. These responses can be initiated manually or automatically in response to detected threats, dramatically reducing the time to respond and minimizing any risk exposure.

Log Management

The ability to collect events and logs from across your servers, services, and applications, and to consolidate them centrally for storage and analysis is a security best practice and is central to the log management capability of the USM platform. It collects, parses, and analyzes log data from your on-premises and cloud environments, facilitates analysis and correlation to detect threats, and dramatically simplifies trend analysis and forensics investigations.

Security & Compliance Reports & Views

Reports, dashboards, and views are key components to performing day-to-day monitoring of your environment, presenting status to your management, and demonstrating to an auditor that your security controls are implemented and working. The USM platform provides numerous security event, compliance, and security framework reports to support your efforts. Available reports include those for the NIST Cybersecurity Framework (NIST CSF), to which the AICPA has published a mapping that demonstrates how you can adopt NIST CSF to demonstrate SOC 2 Compliance.

Integrated Threat Intelligence

The SOC 2 Security Principle focuses on risk identification and remediation. Yet, to successfully identify and mitigate the risks from cybersecurity threats and vulnerabilities, any security tool (or security professional) needs to know what to look for and then how to mitigate that risk. The USM platform is continuously updated with threat intelligence, including correlation directives, threat and vulnerability assessment signatures, report updates, and incident response templates, from Alien Labs Security Research Team, backed by the Open Threat Exchange® (OTX™). This ensures that you can detect the latest cybersecurity threats and vulnerabilities quickly, and that the guidance on how to contain and remediate the risk is available to you automatically so that you don’t have to do the research yourself.