What is SOC 2?
SOC 2 is an attestation framework of the American Institute of CPAs (AICPA). A licensed CPA firm examines a service organisation's controls and issues a report on them for customers and partners. It is a report, not a certificate.
The examination is based on the Trust Services Criteria: Security (always in scope), Availability, Processing Integrity, Confidentiality and Privacy. You choose the additional categories that are relevant to the services you provide.
SOC 2 Type I vs Type II
- Type I: the auditor checks whether your controls are suitably designed at a specific point in time
- Type II: the auditor checks whether the controls operated effectively over a period, usually 3 to 12 months
- Many companies start with Type I to unblock sales and then move to Type II
- In both cases you need written policies and evidence that the controls actually work
What the SOC 2 compliance checklist covers
The questions follow the Common Criteria that an auditor tests for the Security category:
- Control environment, governance and security roles
- Risk assessment and vendor management
- Logical and physical access control, onboarding and offboarding
- System operations: monitoring, vulnerability management and incident response
- Change management and secure development
- Backup, business continuity and availability
Typical gaps before a SOC 2 audit
- Policies exist but were never approved or communicated to employees
- Access reviews and offboarding are not documented
- No formal risk assessment or vendor risk review
- Changes go to production without review or approval records
- Logging and alerting exist, but nobody reviews them regularly
Who asks for a SOC 2 report?
SOC 2 is most often requested by US customers of SaaS, cloud and data processing companies. For European companies selling to the US market, a SOC 2 report is often combined with ISO/IEC 27001, because the controls overlap significantly. The self-assessment helps you see which controls you already have and what is missing.