What is SOC 2?
SOC 2 is an AICPA attestation that reports how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. An independent CPA firm issues it, either as a Type I report on control design or a Type II report on operating effectiveness over a period, typically three to twelve months.
TL;DR
- Security is always in scope.
- Type II needs an observation period, typically three to twelve months.
- Only CPA firms issue SOC 2 reports.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does SOC 2 work in practice?
SOC 2 (System and Organization Controls 2) is defined by the AICPA and is one of the most requested attestations for SaaS and cloud companies. A SOC 2 report is produced by an independent auditor and describes the controls a service organization has in place to protect customer data.
There are two report types. A SOC 2 Type I report assesses control design at a single point in time, while a SOC 2 Type II report evaluates whether those controls operated effectively over a period, typically three to twelve months.
Achieving SOC 2 readiness involves defining controls, collecting evidence that they operate as intended, and remediating gaps. Continuous evidence collection and control monitoring substantially reduce the manual effort of preparing for a Type II audit.
What else do people ask about SOC 2?
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by a CPA firm, not a certificate, although people often call it a certification.
Is SOC 2 required by law?
No, but many B2B buyers require a SOC 2 report from vendors that handle their data.
Go deeper: SOC 2 compliance guide
Which terms are related to SOC 2?
- ISO 27001ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current 2022 edition, amended in 2024, requires a risk assessment, a Statement of Applicability covering 93 Annex A controls, internal audits and management review. Accredited certification bodies certify organizations for three years, with annual surveillance audits in between.
- Evidence CollectionEvidence collection is gathering the records that prove compliance controls are designed well and operating as intended, such as access reviews, configuration exports, change tickets, scan results and policy acknowledgements. Auditors sample this evidence across the audit period. Automated collection pulls it from source systems on a schedule instead of relying on screenshots.
- Continuous ComplianceContinuous compliance is the practice of monitoring controls and collecting evidence all the time, not just before an audit, so an organization knows its compliance posture on any given day. Integrations watch source systems, alerts fire when a control drifts, and issues are fixed close to when they occur, which matters most for SOC 2 Type II.
- Audit ReadinessAudit readiness is the state of having controls implemented, evidence current and known gaps fixed, so an organization can start an audit at any time without a last-minute scramble. It results from continuous monitoring and automated evidence collection, and it also speeds up customer security reviews and recertification.