“Celonis' addition of a SOC 1 Type 2 attestation and expansion of our ISO 27001 certification continue to demonstrate our commitment to customer trust and enhancing transparency of our security controls and operations used to protect customer data,” said Omesh Agam, CISO at Celonis.
Celonis is first process mining and execution management vendor to achieve SOC 1 Type 2 accreditation
In early 2022, Celonis completed two important information security achievements. Most notably, Celonis became the first execution management and process mining vendor to reach SOC 1® compliance. Secondly, the company successfully completed an ISO 27001 extension audit in March, expanding the scope of Celonis’s ISO 27001 certification.
What are SOC 1/SOC 2 and why do they matter?
Verifiable, independent standards are crucial for building and maintaining trust between organizations and their service providers, especially for software-as-a-service (SaaS), process analysis and automation vendors with deep access to customer data and business processes.
System and Organization Controls (SOC) reports, developed by the American Institute of Certified Public Accountants (AICPA), are designed to demonstrate that service providers are meeting high standards for security, confidentiality, privacy, availability and processing integrity. SOC reports are also important for evaluating the effect of the service provider’s controls on the customer’s financial statements.
Completing SOC audits and the subsequent attestations play an important role in vendor selection for many companies. For example, the Sarbanes–Oxley Act of 2002, often referred to as Sarbox or SOX, requires that public companies in the United States follow specific financial record keeping and reporting practices. Many U.S. public companies will therefore require that vendors supply a SOC 1 report so they or their auditors may evaluate the effect of the vendor’s controls on their own internal controls over financial reporting.
SOC 1 and SOC 2 audits may look at similar controls, but the scope of the testing is different. As mentioned above, a SOC 1 audit tests internal controls for systems that can affect financial reporting. A SOC 2 audit tests controls related to the service provider’s operations and compliance, which for Celonis includes security, availability and confidentiality controls.
Within SOC 1 and SOC 2 reporting, there are also Type 1 and Type 2 attestations. A Type 1 report includes an audit of the design of controls to meet SOC control objectives as of a particular point in time. A Type 2 report evaluates the controls’ design over a period of time, usually 6 or 12 months.
Celonis achieves SOC 1 and SOC 2 compliance
Celonis passed the SOC 2 Type 1 audit in 2020 and became the first process mining vendor to achieve SOC 2 Type 2 accreditation in 2021. The company is now the first process mining and execution management vendor to achieve SOC 1 Type 2 compliance. According to Omesh, achieving this latest milestone is integral to supporting customers’ financial statement audit and compliance needs. He said:
“Celonis' addition of our SOC 1 Type 2 independent audit provides additional assurance to our customers that industry-leading security, operational controls and safeguards are built into every layer of our Execution Management System.”