How to Choose the Right VPN: What Auditors Look for in a Compliant Remote Access Environment

Now we typically see companies rely on remote or hybrid workforces where personnel work remotely from home rather than working in an office. When personnel work remotely, companies should consider how they will manage remote personnel devices and access to networks and internal systems. There are many approaches to managing a remote workforce, and one of the methods widely used by companies is the use of a virtual private network (VPN) to create a secure encrypted connection between personnel devices and the corporate network and/or systems.

A company’s approach to managing its remote or hybrid workforce and how access to the internal network and/or systems is secured is important when establishing a strong internal control environment and will likely be a consideration in your company’s internal and external security audits; for example, a SOC 2 examination. In this article, we will discuss what a VPN is, whether you need one, its relevance in a SOC 1 or SOC 2 examination, and things to consider when selecting a VPN, as well as remote access and VPN security considerations.

What is a VPN, & Why Do Auditors Care?

VPN stands for Virtual Private Network and, in basic terms, it is used to create a secure connection and encrypt communications between devices and corporate networks, internal systems, and websites. VPNs can be used by many different types of users and use cases, but in this article I will be focusing on VPN usage from the perspective of a company using a VPN for remote workers to connect to the corporate network and/or internal systems. The use of the right VPN aids a company in meeting security and privacy requirements by encrypting data connections and reducing exposure risk on public or unsecure networks.

A VPN prevents the data that you are transferring over the internet from being viewable by other users. A VPN is a tool used for protecting privacy, as it masks the user’s IP address, which provides an indication of the user’s general location, so that the IP address appears as the same address as the VPN server.

Do I Need a VPN? What SOC 2 Does (& Doesn’t) Require

With a large portion of companies utilizing a remote or hybrid workforce model, the use of a VPN or other secure method to connect to internal networks and systems is a topic of consideration for companies that undergo SOC 1 and/or SOC 2 examinations. The right VPN aids companies in meeting privacy requirements by encrypting connections and reducing exposure risk related to connections between personnel devices and the internal corporate network and/or systems. That said, there is no specific SOC 1 or SOC 2 requirement stating a VPN must be used for remote access to networks and systems.

This is a common misconception I have seen when clients are considering what controls have to be implemented to meet the SOC 2 criteria. When I consider a client’s IT environment and controls for a SOC 1 or SOC 2 report, I am typically considering it from the larger scope of how remote access to network resources and systems is being secured. Oftentimes, a VPN is used, but there are many other methods a company can use for securing connections to a network and internal systems.

People often ask why a VPN is needed when people are using their at-home wifi connection to work remotely. Even if company personnel are using their at-home wifi that is secured with a password, their wifi could still be susceptible to exposure and security risks. Since companies have little to no control over the security of their personnel's at-home wifi connections and other internet connections, requiring that personnel use an authorized VPN when accessing the company network and internal systems adds a layer of data security that can be controlled by the company.

How to Choose a VPN: Considerations From the Audit Side

Many companies have a company-wide VPN that they use to manage their workforce devices and connections to internal networks and systems. We have also seen smaller companies that require personnel to use a VPN, but they are allowed to use the VPN of their choice. Allowing personnel to select a VPN on their own could be considered a risky choice from an auditor’s perspective because not all VPN providers are created equal and specific security and privacy considerations need to be taken into consideration.

When selecting a VPN provider, how to choose which one is right for your company not only depends on security but also service provider reliability, device compatibility, and connection speeds that support the number of users and traffic, to name a few things. You don’t want to end up with a VPN that slows down connection speeds or impacts the availability of systems and personnel. Price point is also a main driver for the selection of VPN services, and while the option that is free is typically not the right choice, neither is the most expensive. There are many articles available covering different reputable VPN providers and their benefits and shortcomings that are helpful when researching the right VPN provider for your company.

When selecting a VPN provider, reading the VPN provider’s privacy policy and comparing it to your own company’s privacy policy to make sure required privacy terms and commitments are being met is also important. This will help you understand how and if they are collecting data, what types it is collecting, and what they are using it for. Some VPN providers also have independent audits that have been performed, and the reports are available by request for review. Independent audit reports issued by reputable independent auditors can be another great way to learn about the VPN provider and how it handles and secures data and connections.

Is There a Downside to Using a VPN?

The VPN provider selected also comes into play when considering the downsides to using a VPN. As previously mentioned, a VPN can slow down connection speed, cause availability issues, be incompatible with certain devices and systems, and collect and sell your data. With many corporations moving away from a traditional corporate network infrastructure to a cloud-based or more decentralized model, it may make sense to only have personnel use a VPN to access certain high-risk systems and resources.

With compatibility, speed, performance, and availability issues to consider, as well as how your data is being protected and used, some companies are forgoing the use of a VPN altogether and using other secure remote access methods such as Zero Trust Network Access (ZTNA), Virtual Desktop Infrastructure (VDI), etc. From an auditor's perspective, for a SOC 1 or SOC 2, either method is acceptable as long as the method selected to secure remote access addresses the company’s security risks and mitigates those risks to an acceptable level.

Remote Access Security Considerations Beyond the VPN

There are no specific SOC 2 criteria or SOC 1 objectives issued by the AICPA (opens in a new tab) that detail specific requirements for VPN use. But there are several SOC 2 criteria that the use of a secure VPN could be mapped to, for example, in the common/security criteria, CC6.0 related to logical and physical access controls. When performing a SOC 1 or SOC 2 audit, the VPN used, or if one is used, is not the only or most important security consideration for auditors when meeting the applicable criteria or control objectives related to remote access to network resources and systems. There are many ways in which remote access can be secured and many different controls that should be in place and can be relied on by auditors, in addition to or instead of the use of a VPN. A few other ways of securing your network and personnel devices online that are common controls in SOC 1 and SOC 2 reports include, but are not limited to:

• Enabling strong password policies
• Setting up two-factor or multifactor authentication
• Encrypting personnel devices
• Installing software updates and security patches on devices when they are made available

VPN Security Considerations: MFA, Access Reviews, and Patching

If you do decide to use a VPN, there are some other measures or VPN best practices that should be considered in order to maintain a secure connection. One of the easy ones is enabling multifactor authentication (MFA) when logging into your VPN, which will add an extra layer of security to help prevent unauthorized access. Another consideration is reviewing user access to the VPN on a periodic basis to make sure only authorized users have access. This control helps detect inappropriate access to the VPN and internal resources and systems and correct it before it can be taken advantage of.

Making sure your VPN is up-to-date and all necessary patches have been applied is also critical to maintaining a secure connection. By applying patches for known vulnerabilities and security updates to keep the VPN up-to-date, you are protecting your connections to internal networks and systems from being susceptible to certain vulnerabilities that can be exploited by hackers. But know that a VPN alone cannot be the only security measure in place to protect yourself and your networks from hackers. There are many facets to maintaining a strong control environment, including implementing the use of and maintaining a reliable VPN.

Final Thoughts: A VPN Is a Tool, Not a Control Strategy

In this blog, we covered the basics of what a VPN is and if you need one, some VPN pros and cons, and remote access security and VPN requirements and considerations. We laid out the reasons why a VPN could be useful when managing a remote or hybrid workforce and how to select the right VPN for you and your company.

I’m an auditor, not a VPN vendor, and that’s what makes this perspective useful. I’m not here to tell you which product to buy. I’m looking at whether your remote access controls work and whether you can show evidence that they do. Whether you use a VPN, ZTNA, or another method, that’s the question an auditor will ask. I hope this provides a starting point for understanding how a VPN can be one of the methods used to secure remote access to networks and systems, how to maintain it, and supplemental security controls to consider.

For more information on undergoing a SOC 1 or SOC 2 audit and how the use of a VPN, or lack thereof, could impact your audit, please contact us.

This article was originally published on 4/22/2020 and was updated on 11/4/2026.