SOC Reporting Requirements. (a) Subject to this section and unless otherwise agreed to in writing by the Commonwealth, the Contractor shall, and shall require its subcontractors to engage, on an annual basis, a CPA certified third-party auditing firm to the following, as applicable:
(i) a SOC 1 Type II report with respect to controls used by the Contractor relevant to internal and external procedures and systems that process Commonwealth financial transactions; and
(ii) a SOC 2 Type II report with respect to controls used by the Contractor relevant to internal and external procedures and systems that access, process, host or contain Commonwealth Data designated as Class “C” Classified Records or Closed Records, as defined in ITP-SEC019, or in compliance with mandates by federal or state audit requirements and/or policy. Unless otherwise agreed to in writing by the Commonwealth, SOC Reports shall be provided upon contract execution and annually thereafter. While it is preferable that SOC Reports coincide with Pennsylvania’s fiscal year (July 1 through June 30), SOC Reports, at the very least, must cover at least 6 consecutive months of Pennsylvania’s fiscal year.
(b) SOC 2 Type II report reports shall address the following:
(i) Security of Information and Systems;
(ii) Availability of Information and Systems;
(iii) Processing Integrity;
(iv) Confidentiality;
(v) Privacy; and
(vi) If applicable, compliance with the laws, regulations standards or policies designed to protect the information identified in ITP-SEC019 or other information identified as protected or Confidential by this Contract or under law.
(c) At the request of the Commonwealth, the Contractor shall complete a SOC for Cybersecurity audit in the event:
(i) repeated non-conformities are identified in any SOC report required by subsection (a); or
(ii) if the Contractor’s business model changes (such as a merger, acquisition, or change sub-contractors, etc.). The SOC for Cybersecurity report shall detail the controls used by the Contractor setting forth the description and effectiveness of Contractor’s cybersecurity risk management program and the policies, processes and controls enacted to achieve each cybersecurity objective. The Contractor shall provide to the Commonwealth a report of the SOC for Cybersecurity audit findings within 60 days of its completion.
(d) In addition to Appendix G, Framework for Independent Third-Party Security and Privacy Assessment Guidelines for Medicaid Enterprise Systems (MES) and this Attachm...
SOC Reporting Requirements. Subject to this section and unless otherwise agreed to in writing by the Agency, the Licensor shall, and shall require its subcontractors to, engage, on an annual basis, a CPA certified third-party auditing firm to conduct the following, as applicable:
SOC Reporting Requirements. Service Organizations hosting software services off campus are required to submit a Service Organization Control (SOC) Report type 2 or 3 per the IT Security Manual prior to issuance of the Purchase Order. Such audits shall be performed at least annually during the term of the contract and the report of the audit submitted to YSU. The Contractor shall agree to implement recommendations as suggested by the audits within three months of report issuance at no cost to YSU.
