SOC 2
SOC 2Also called SOC 2 report, system and Organization Controls 2
SOC 2 is an independent auditor's report on a service organisation's controls relevant to security, availability, processing integrity, confidentiality and privacy. It follows standards set by the American Institute of CPAs. Banks and insurers ask technology vendors for a SOC 2 report as evidence that customer data and systems are protected.
How it works
A vendor chooses which Trust Services Criteria to cover. Security is always included. A licensed CPA firm then examines its controls. A Type 1 report tests whether controls are suitably designed at a single date. A Type 2 report tests whether they operated effectively over a period, usually six to twelve months. The report lists exceptions and the controls the customer must run itself.
For a regulated firm, a SOC 2 Type 2 report is a standard input to vendor due diligence and ongoing third-party risk monitoring. Reviewers read the exceptions, the subservice organisations carved out and the complementary user entity controls. SOC 2 is an attestation, not a certification, and is not a legal requirement. Regulators expect firms to oversee outsourced services, and the report is common evidence.
The rules
Sets the attestation standard under which SOC 2 examinations are performed and reported.
CPA firms performing SOC examinationsDefines the five criteria categories against which a service organisation's controls are evaluated in a SOC 2 report.
Service organisations undergoing SOC 2 examinationsCommon questions
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 reports on whether controls are suitably designed at a point in time. Type 2 also tests whether they operated effectively over a period, usually six to twelve months. Banks generally expect a Type 2 report from critical vendors.
Is SOC 2 a certification?
No. SOC 2 is an attestation report in which a CPA firm gives an opinion on controls. There is no certificate and no pass mark. Readers judge the report on its scope, opinion and any exceptions.
What is the difference between SOC 2 and ISO 27001?
ISO 27001 certifies that an organisation runs an information security management system and is common outside the US. SOC 2 reports on how specific controls performed against AICPA criteria. Many vendors hold both.
How long is a SOC 2 report valid?
There is no formal expiry. Each report covers a defined period. Most customers expect a new Type 2 report every year, plus a bridge letter covering the gap since the last period ended.
