What is SOC 2?

Definition

SOC 2 (System and Organization Controls 2) is an attestation report produced by a licensed CPA firm under AICPA standards. It evaluates the controls a service organization uses to protect customer data against one or more of the Trust Services Criteria.

Background

SOC 2 was created by the American Institute of Certified Public Accountants (AICPA). It is an auditor’s opinion on whether your controls are suitably designed (Type I) and operating effectively over a period, typically 3 to 12 months (Type II), rather than a certification you pass or fail. The Security criterion, also called the Common Criteria, is always in scope; Availability, Processing Integrity, Confidentiality, and Privacy are added based on the promises you make to customers. SOC 2 is one report in the AICPA’s SOC suite. SOC 1 covers controls relevant to a customer’s internal control over financial reporting, and SOC 3 is a short general-use report built on the same criteria as SOC 2. The acronym once stood for Service Organization Controls; the AICPA now calls the suite System and Organization Controls. The Common Criteria start with the components of the COSO internal control framework, beginning with the control environment, and then add criteria for logical and physical access, system operations, change management and risk mitigation.

Why it matters

For many B2B software companies, a SOC 2 report is what enterprise buyers ask for when they evaluate data protection. It contains management’s assertion, the system description and the auditor’s opinion, and a Type II report adds the tests the auditor ran and any exceptions. A current report whose scope and period cover the service a buyer relies on shortens their security review. The report is written for your customers, which the AICPA calls user entities, and for their auditors. It usually lists complementary user entity controls: things the customer has to do on its side, such as removing access for its own staff when they leave. A reader who skips that section can assume your controls cover more than they do.

Step by step

1. Choose your report type (Type I to start, or go straight to Type II) and which Trust Services Criteria apply beyond Security.
2. Define your system scope: the product, infrastructure, and data in the report.
3. Draft the system description early. It names the services, infrastructure, people, data and subservice organizations (such as your cloud host) that the report covers, and the auditor tests your controls against it.
4. Implement the controls: access management, change management, monitoring, vendor management, and incident response.
5. Collect evidence continuously (policies, tickets, logs, reviews) rather than scrambling before the audit.
6. Run a readiness assessment to find gaps, then remediate them.
7. Engage a licensed CPA firm for the audit; for Type II, sustain the controls across the observation window.
8. Once the report is issued, give customers who ask between reports a bridge letter covering the time since your period ended, and start the next period straight away so coverage has no gaps.

Examples

• A 20-person SaaS startup pursues a SOC 2 Type II covering Security and Availability because its customers run on the product during business hours.
• A payroll platform adds the Confidentiality and Privacy criteria because it handles sensitive personal data on behalf of clients.
• A company hosted on a large cloud provider uses the carve-out method. Its report excludes the provider’s controls, and customers read the provider’s own SOC 2 report for that layer.

Common mistakes

• Treating SOC 2 as a one-time project instead of an ongoing control program, so the next Type II period starts from zero.
• Over-scoping the criteria: adding Privacy or Processing Integrity you don’t need multiplies the work.
• Collecting evidence manually at the last minute instead of capturing it as work happens. An approved policy on its own does not show that a recurring review actually ran throughout a Type II period.
• Writing vague complementary user entity controls, so customers cannot tell which duties stay with them.

FAQ

Free tools and downloads

• SOC 2 cost calculator
• SOC 2 evidence kit