What is SOC 2?

What is SOC 2?

SOC 2 is a report on a service organization's controls, produced by an independent certified public accounting (CPA) firm under attestation standards set by the American Institute of Certified Public Accountants (AICPA). SOC stands for System and Organization Controls. Cloud providers, SaaS vendors, managed service providers and data centers commission SOC 2 reports so they can give customers independent evidence about how they protect customer data, instead of answering every customer's questionnaire from scratch.

A SOC 2 report is an attestation, not a certification. There is no SOC 2 certificate; the CPA firm issues an opinion on management's description of its system and on its controls.

The Trust Services Criteria

Controls are evaluated against the AICPA's Trust Services Criteria, grouped into five categories:

• Security: protection against unauthorized access and misuse. Every SOC 2 report includes it.
• Availability: the system is available for operation and use as committed.
• Processing integrity: processing is complete, valid, accurate, timely and authorized.
• Confidentiality: information designated as confidential is protected.
• Privacy: personal information is collected, used, retained, disclosed and disposed of as committed.

The service organization chooses which categories beyond security to include, so a customer has to check that the report covers what matters for its use of the service.

SOC 2 Type I vs. Type II

A Type I report shows the controls looked right on one date. A Type II report shows they actually worked over time, which is why customers performing vendor due diligence usually ask for Type II.

Reading a SOC 2 report

Receiving a report is not the same as reviewing it. A customer checks:

• Scope: whether the specific service, systems and locations being purchased are covered.
• Period: how recently it ended. Vendors often cover the gap until the next report with a bridge letter, a statement from management that no auditor has tested.
• Exceptions and opinion: control failures the auditor found, and whether the opinion is qualified.
• Complementary user entity controls: controls the customer must run for the vendor's controls to work, such as reviewing its own users' access.
• Subservice organizations: if the vendor's hosting provider is carved out of the report, the customer needs that provider's report too.

SOC 2 reports contain sensitive detail, so vendors usually share them only under a nondisclosure agreement.

SOC 2 vs. SOC 1, SOC 3 and ISO/IEC 27001

• SOC 1 covers controls relevant to customers' financial reporting, which matters for vendors such as payroll processors.
• SOC 3 is a short, general-use summary of a SOC 2 without the detailed test results, suitable for publishing.
• ISO/IEC 27001 is a certification: an accredited body certifies that the vendor's information security management system conforms to the standard, on a three-year cycle with surveillance audits.
• A PCI DSS Attestation of Compliance covers the handling of payment card data specifically.

SOC 2 on the CompTIA Security+ exam

SOC 2 reports appear under SY0-801 objective 5.3 as evidence gathered during vendor due diligence and ongoing third-party assessment, and they are the standard example of the independent attestation engagements covered under objective 5.5. When a scenario asks how to confirm that a vendor's controls actually worked over the past year, the answer is a current SOC 2 Type II report with the right scope. A Type I report is the distractor when the question stresses operating effectiveness over time, a SOC 1 report is the distractor when the concern is security rather than financial reporting, and the vendor's own questionnaire answers or self-attestation carry less weight than an independent report.