SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit

SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Assessments can be used against your company in court proceedings. Here's how to mitigate this potential risk.

SOC 2 audits and third-party technical assessments are useful tools for an organization to use in navigating the security risks it may face. But these security road maps also can provide direction to a plaintiff's counsel suing your organization in a later lawsuit related to a data breach. If the assessment describes your organization as being riddled with security vulnerabilities and, after the assessment, one of these unrepaired vulnerabilities is utilized to infiltrate your network, the assessment becomes proof that your organization knew about the risk and did not fix it.


On the flip side, engaging a third party to assess your security risk can also be used as a defense in court proceedings, showing that your organization engaged unbiased third parties to determine what risks it might face. In that way, an assessment can be a powerful tool in later court proceedings.


How do you mitigate against this potential future risk? Here are two strategies you can employ.


1. Think hard about who you're engaging and the services they provide.In the last few years, there has been a proliferation of service providers claiming to offer technical security assessments. In determining who to hire, budget can't be your primary driver. Are your own customers requiring you to have a SOC 2 audit? Then you will need to engage a CPA firm that offers auditing services covering the Systems and Organizational Controls 2 (SOC 2) as put forward by the American Institute of Certified Accountants. Outside of a SOC 2, you may engage technical firms to perform assessments based on a variety of approaches, including the matrix from the National Institute of Standards and Technology.


But keep in mind ..

Support the originator by clicking the read the rest link below.