SOC 2 (Service Organization Controls 2) is the AICPA examination report on a service organization's controls measured against the Trust Services Criteria. It runs under SSAE 18, AT-C 105 plus AT-C 205, and is restricted to the customer, their auditors, and other named parties.
What are the five Trust Services Criteria?
Security plus Availability, Processing Integrity, Confidentiality, and Privacy. Security is the only category every SOC 2 report must cover.
The other four are elected based on the service and what the customer contracts for. Per the AICPA 2017 TSC with revised points of focus, 2022, the categories are:
- Security (always in scope; the Common Criteria)
- Availability (uptime and resilience commitments)
- Processing Integrity (transactions complete, valid, accurate, timely, authorized)
- Confidentiality (information designated confidential is protected)
- Privacy (personal information handled in line with the entity's privacy notice)
What's the difference between SOC 2 Type 1 and Type 2?
Type 1 reports on control design at a single date. Type 2 reports on operating effectiveness across an audit window of three to twelve months.
A Type 1 is usually how a company gets its first report out the door, with the Type 2 audit window starting immediately after. The AICPA SOC 2 page defines both types under the same examination standard. Most enterprise buyers accept a Type 1 once, then expect a Type 2 by the next renewal. Coalfire, A-LIGN, and Schellman are the names we see most often on SOC 2 reports buyers send through TPRM.
Why do buyers always ask for SOC 2?
Almost every US enterprise security questionnaire asks for a current SOC 2 Type 2; many will not start a procurement cycle without one in hand.
The report is the artifact buyers paste into their TPRM file. Unlike a SOC 3, it contains the auditor's detailed test procedures and results, which a buyer's security team reads for exception findings before approval.
Related terms
These adjacent terms appear in every SOC 2 conversation; the criteria scope the audit and the related reports anchor what a buyer reads next.
- SOC 1 - the financial-controls counterpart under AT-C 320, not a security report
- SOC 3 - the publishable summary version a vendor can post on its trust page
- TPRM - the vendor-review motion in which the SOC 2 gets read
- SIG - the questionnaire whose first questions are usually about your SOC 2 scope and date