The Schellman Blog

SOC 2 reports are soon going to look different. The AICPA has opened a revised Trust Services Criteria (TSC) for comment with an expectation to release in 2027. While organizations should pay attention, similar to the changes in HIPAA’s Safeguards, these are still very much in draft and are subject to change prior to official release.

Cyber and AI risk assurance in a single examination to close the gap between traditional cyber assurance and the realities of autonomous AI. Developed in collaboration with the AICPA and AIUC and delivered by Schellman.

I remember sitting in a Major Firms Group meeting several years ago when Barry Melancon, then CEO of the AICPA, said something that has stayed with me ever since: CPAs have always been in the trust business.

If you’ve heard “FedRAMP” and immediately thought “that’s a year-long, million-dollar project we’re not ready for” — this post is for you. A lot has changed. The program's new Class A certification tier was built specifically for companies that have already done the hard work of achieving SOC 2 Type II. Here’s what your SOC 2 actually gets you, and why the path to the federal marketplace may be shorter than you think.

If you’re considering a SOC 2 audit, be it due to a customer request or to strengthen your security posture, you may already understand that this examination will include an evaluationof your product or service on a more operational and security-oriented level.You may even already grasp that during a SOC 2, your scope will be evaluated against a set of trust servicescriteria (TSC) that provide the backbone of the assessment. But what are the trust services categories, the criteria that make up each category,and which ones will you actually need for your SOC 2 audit? At Schellman, we have over two decades of experience in SOC 2 examinations, and we want to help you navigate what can be a complex process. Read onto discover what inclusion of each category will mean for your SOC 2 examination. From there, we’ll give you some guidelines for your internal conversations when making your choice. Afterwards, you’ll be that much closer to pinning down what you need from your upcoming SOC 2 report.

Have you read the recently released America’s AI Action Plan yet? If so, you know that it’s full of ambitious goals to strengthen the country’s leadership in artificial intelligence. For me, one part in particular stood out immediately, the White House issued a clear call to action to the data center industry.

As cloud services continue to expand globally, service providers are increasingly expected to demonstrate compliance with a variety of frameworks depending on where their customers operate. Two commonly requested assurance reports include the American Institute of Certified Public Accountants (AICPA) SOC 2 attestation report and the German Federal Office for Information Security (Bundesmat fur Sicherheit in der Informationstechnik, or “BSI”) Cloud Computing Compliance Criteria Catalogue (C5) attestation report.

Opting for a readiness assessment ahead of your SOC 2 examination is—while optional—a beneficial extra step when seeking compliance. Do you remember taking a practice test while preparing for an exam in school? It allows you to understand your weaknesses before undergoing the actual test. That being said, there are some things you should understand ahead of your readiness assessment that can help enhance your experience.