DCC Service Organisation Control 2 (SOC2) Assessments
Summary
Currently within the Central Switching Service (CSS) Service Definition document there is a requirement for the CSS Provider to arrange for and undertake system organisation control type 2 (SOC2) assessments on the CSS’s cloud-based infrastructure. This Change Proposal seeks to determine if it is appropriate for the requirement for assurance on the CSS’s cloud-based infrastructure to be changed from ‘SOC2 Type 2’ to ‘independently assessed’.
Latest update and next planned activity
Date of latest update
Latest Update
26/06/2024 - The Technical Expert Panel have rejected R0048 in line with the Code Manager's recommendation.
Impacts Overview
Impacted REC Parties and Market Participants
DCC
Impacted REC Services
Central Switching Service (CSS)
Priority and rationale
Standard
Priority last updated on 29 May 2026
Solution development
Problem Statement
The CSS Provider asserts that SOC2 assessment does not provide a proportionate level of assurance or the best value for money, which based on their experience, they believe they have a better understanding of the CSS’s risk profile. However, the use of SOC2 assessments is currently defined within the CSS Definition document, which means an alternative assurance regime cannot be used.
Proposed solution summary
- As the Code Manager, I want REC Service Providers to obtain and maintain appropriate security certification, so I have confidence that the Service Providers security, processing integrity, confidentiality and privacy controls are assessed, and any risks are identified and addressed.
- As the CSS Provider, I want to be able to obtain an appropriate security certification, so I can demonstrate security compliance in a proportionate and cost-effective approach.
No documents available.
Change Plan
Service Provider Impact Assessment
Completed
Start:
20 May 2022Due:
16 Jan 2023Completion:
08 Feb 2023Solution Development
In Progress
Start:
16 Jan 2023Due:
24 Nov 2023Completion:
Original submission
Change details
Ann Perry - DCC
20 May 2022
Change details
DCC Service Organisation Control 2 (SOC2) Assessments
Experience has shown SOC Type 2 to be both inappropriate and costly in the SEC and would be vast over application of assurance within the Switching service now that DCC have a better understanding of the risk profile.
Without removing the requirement for a SOC Type 2 security certificate DCC would need to procure an assurance framework that is costly and inappropriate to the needs of the switching service.
Replacing the requirement for a SOC Type 2 security certification with an “independently assured” requirement would allow for a better suited regime to be implemented by the DCC which will allow greater value and assurance.
The requirement for SOC2 was in the Code of Connection (CoCo) but not in the Design Baseline 4 (DB4) requirements.
Impacts
Other (please specify in the Additional information box below)
Other (please provide details in Additional information box below)
No direct impact to Consumers
No details provided
CSS Service Definition
No details provided
-
No details provided
-
No details provided
-
No details provided
-
Central Switching Service (CSS)
-
DCC
-
No details provided
-
No
No details provided
Priority & timing
No
-
The change to the SOC Type 2 requirement will need to be in place ahead of August 2023, however DCC would require the change to be agreed much earlier to allow for changes to the DCC Service Provider contracts to be carried out.
-
No details provided
-
Activity
Proposed solution summary changed to As the Code Manager, I want REC Service Providers to obtain and maintain appropriate security certification, so I have confidence that the Service Providers security, processing integrity, confidentiality and pri…
Proposed solution summary changed to As the Code Manager, I want REC Service Providers to obtain and maintain appropriate security certification, so I have confidence that the Service Providers security, processing integrity, confidentiality and privacy controls are assessed, and any risks are identified and addressed.As the CSS Provider, I want to be able to obtain an appropriate security certification, so I can demonstrate security compliance in a proportionate and cost-effective approach..
Show more