MP103 'DCC SOC2 Assessments'

Currently, SEC Section G requires the Data Communications Company (DCC) to undertake an annual Systems Organisation Controls 2 (SOC) 2 assessment to gain independent assurance of its compliance with the SEC security obligations and the security controls in place at DCC and its Service Providers. Unnecessary cost is incurred in both undertaking the assessment and in complying with an assurance framework that does not relate to the SEC provisions.

The proposed solution is to retain the approach that requires the DCC to procure a DCC Security Assessment (whereby the procurement effort and cost of the assessment is for the DCC to bear) but to emulate the User Security Assessment process by adopting much of the legal text in Section G8 that applies to Users.