SOC 2 (Service Organization Control 2) is an AICPA framework for evaluating controls at service organizations that handle customer information or provide technology-enabled services. It focuses on five Trust Services Criteria; security, availability, processing integrity, confidentiality, and privacy.
A SOC 2 examination evaluates whether relevant controls are suitably designed and, for a Type II examination, whether they operate effectively over a defined period. An independent service auditor assesses the organization’s systems and controls against the applicable criteria.
SOC 2 is commonly used by SaaS providers, cloud service providers, data processors, managed service providers, and other technology organizations to provide assurance about how they manage customer information and related systems.
Table of Contents
What Does SOC 2 Cover?
SOC 2 uses five Trust Services Criteria. Security is the common criterion, while the other criteria can be included when they are relevant to the services and commitments being examined.
| Trust Services Criterion | What It Addresses |
| Security | Controls designed to protect systems and information against unauthorized access, disclosure, damage, or other security threats. |
| Availability | Controls related to the availability of systems and services according to defined commitments or objectives. |
| Processing Integrity | Controls designed to ensure that system processing is complete, valid, accurate, timely, and authorized. |
| Confidentiality | Controls designed to protect information designated as confidential from unauthorized access or disclosure. |
| Privacy | Controls related to the collection, use, retention, disclosure, and disposal of personal information. |
An organization does not necessarily need to include all five criteria in every SOC 2 examination. The applicable scope depends on the services provided, contractual commitments, customer requirements, and the organization’s control objectives.
How Does SOC 2 Work?
A SOC 2 engagement begins by defining the system under examination and identifying the Trust Services Criteria relevant to that system.
The organization documents its systems, processes, risks, control objectives, and controls. An independent service auditor then performs procedures to evaluate the controls within the examination scope.
A typical SOC 2 process includes:
- Define the scope: Identify the services, systems, infrastructure, applications, processes, and locations covered by the examination.
- Select applicable criteria: Determine which Trust Services Criteria are relevant to the organization and its services.
- Document the system: Describe the technology, people, processes, data, and procedures supporting the services.
- Evaluate control design: Determine whether relevant controls are suitably designed to address identified risks.
- Test controls: For a Type II examination, test whether controls operated effectively throughout the examination period.
- Issue the report: The service auditor provides a SOC 2 report containing the system description, applicable criteria, control information, and examination results.
SOC 2 Type I vs. SOC 2 Type II
SOC 2 reports are commonly classified as Type I or Type II. The primary difference is whether controls are evaluated at a specific point in time or over a defined period.
| Feature | SOC 2 Type I | SOC 2 Type II |
| Focus | Design and implementation of controls | Design, implementation, and operating effectiveness |
| Time perspective | Point in time | Defined examination period |
| Control testing | Evaluates controls at a specified date | Tests whether controls operated effectively during the examination period |
| Evidence | Provides information about the control environment at a specific point | Provides evidence about control operation over time |
A SOC 2 Type I report assesses the design and implementation of relevant controls at a specified date. A SOC 2 Type II report goes further by evaluating the operating effectiveness of those controls over a defined period.
What Is Included in a SOC 2 Report?
A SOC 2 report provides authorized users with information about the service organization’s system and relevant controls.
Depending on the engagement, it may include:
- Management’s assertion
- Description of the service organization’s system
- Applicable Trust Services Criteria
- Relevant controls
- Service auditor’s procedures
- Results of control testing
- Exceptions identified during testing, where applicable
- Auditor’s opinion
The system description is an important part of the report because it establishes the boundaries and components of the environment being examined. This may include infrastructure, software, people, processes, procedures, and data relevant to the services within scope.
Why Is SOC 2 Important?
SOC 2 helps organizations provide customers and business partners with structured information about the controls operating within their service environment.
This is particularly relevant when customers depend on an external provider for technology, data processing, cloud infrastructure, or other critical services.
SOC 2 can support:
- Customer assurance: Provides information about controls protecting systems and customer information.
- Third-party risk assessment: Helps organizations evaluate controls at technology and service providers.
- Vendor due diligence: Provides security, compliance, procurement, and risk teams with assurance information.
- Security governance: Documents controls associated with an organization’s technology environment.
- Control monitoring: Establishes a structured basis for reviewing relevant controls.
- Contractual requirements: Helps address customer requirements relating to security, availability, confidentiality, privacy, or processing integrity.
Who Needs SOC 2?
SOC 2 is particularly relevant to service organizations that provide technology or data-related services to other organizations.
Common examples include:
- Software-as-a-Service (SaaS) providers
- Cloud service providers
- Data hosting providers
- Managed service providers
- Data processing organizations
- IT service providers
- Business process service providers
- Cybersecurity service providers
- Technology platforms handling customer information
The relevance and scope of a SOC 2 examination depend on the services provided and the controls that customers or other authorized users need to evaluate.
SOC 2 vs. SOC 1
SOC 2 and SOC 1 address different areas of control assurance.
| Aspect | SOC 1 | SOC 2 |
| Primary focus | Controls relevant to internal control over financial reporting | Controls relevant to the Trust Services Criteria |
| Typical subject matter | Financial reporting-related controls | Security, availability, processing integrity, confidentiality, and privacy |
| Common users | User entities and their financial statement auditors | Customers, business partners, security teams, risk teams, and other authorized users |
| Typical relevance | Services affecting financial reporting | Technology and service environments involving information and systems |
SOC 1 focuses on controls relevant to internal control over financial reporting, while SOC 2 focuses on controls related to the Trust Services Criteria.
SOC 2 vs. SOC 3
SOC 2 and SOC 3 can address the same Trust Services Criteria, but they differ in their intended distribution and level of detail.
| Aspect | SOC 2 | SOC 3 |
| Scope | Trust Services Criteria | Trust Services Criteria |
| Level of detail | More detailed | Less detailed |
| Intended distribution | Restricted to specified users | General use |
| Availability | Distribution is controlled by the service organization | Can be publicly distributed |
A SOC 3 report is designed for general use and provides less detailed information than a SOC 2 report.
Is SOC 2 a Certification?
SOC 2 is not a certification. It is an attestation examination and reporting framework.
An organization undergoes an examination conducted by an independent service auditor, who evaluates the applicable controls and issues a report based on the examination.
For this reason, organizations generally refer to having completed a SOC 2 examination or having a SOC 2 report, rather than holding a SOC 2 certification.
SOC 2 and Cybersecurity
SOC 2 has direct relevance to cybersecurity because the Security criterion addresses controls designed to protect systems and information.
Organizations may use controls covering areas such as:
- Identity and access management
- Authentication and authorization
- Network security
- Security monitoring
- Incident response
- Vulnerability management
- Change management
- Logging and monitoring
- Risk assessment
- Data protection
- Backup and recovery
- Security policies and procedures
The specific controls included in an examination depend on the organization’s system, services, risks, commitments, and selected Trust Services Criteria.
For security teams, SOC 2 can provide a structured way to document how security controls operate within a service environment and how those controls are evaluated by an independent auditor.
Technologies Supporting SOC 2
SOC 2 does not require the use of specific security technologies. However, security and monitoring technologies can help organizations implement relevant controls, maintain visibility across their environments, and generate evidence for security-related processes.
- Network Detection and Response (NDR): Provides visibility into network activity and helps security teams detect suspicious communications, investigate unusual behavior, and support network-level incident investigations.
- Full Packet Capture (PCAP): Preserves network traffic for detailed analysis and can provide network-level evidence during security investigations and incident response.
- Security Information and Event Management (SIEM): Collects and analyzes security logs and events from multiple sources, supporting centralized monitoring, investigation, and security event management.
- Endpoint Detection and Response (EDR): Monitors endpoint activity to identify suspicious behavior and supports investigation and response to security incidents.
- Security Orchestration, Automation and Response (SOAR): Helps automate defined security workflows, response actions, and incident-handling processes.
- Identity and Access Management (IAM): Controls access to systems and resources through identity management, authentication, authorization, and access policies.
These technologies can support controls associated with security monitoring, access management, incident response, and investigation. The specific technologies and controls relevant to a SOC 2 examination depend on the organization’s systems, services, risks, and examination scope.
SOC 2 and Continuous Monitoring
SOC 2 relies on evidence demonstrating how relevant controls are designed and operated. Technology can support this process by collecting and maintaining records related to system activity, access, configuration changes, security events, incidents, and other control activities.
Security and network monitoring technologies can contribute evidence for controls involving system activity, access monitoring, incident investigation, and security operations.
The technology itself does not determine whether an organization satisfies SOC 2 requirements. The examination considers the defined system, applicable criteria, controls, evidence, and auditor procedures.
Conclusion
SOC 2 gives service organizations a clear way to show how they protect systems and customer information through defined controls and independent examination. It also gives customers greater visibility into the controls behind the services they use.
At its core, SOC 2 helps answer a simple but important question; Can customers trust how a service organization manages their systems and information?
A well-defined SOC 2 framework provides the evidence needed to answer that question with greater confidence.
Related Key Terms
- Trust Services Criteria (TSC): AICPA criteria used to evaluate controls related to security, availability, processing integrity, confidentiality, and privacy.
- SOC 2 Type I: A SOC 2 examination that evaluates the design and implementation of relevant controls at a specified point in time.
- SOC 2 Type II: A SOC 2 examination that evaluates the operating effectiveness of relevant controls over a defined period.
- Service Organization: An organization that provides services to another organization where its systems or processes are relevant to the customer’s operations or information.
- Service Auditor: An independent auditor who examines a service organization’s controls and issues the SOC report.
- Control: A policy, procedure, activity, or mechanism designed to address a defined risk or control objective.
- System Description: Management’s description of the service organization’s system, including relevant infrastructure, software, people, procedures, and data.
- SOC Report: A report issued following a System and Organization Controls examination.
Additional Related Terms
- SOC 1: A report focused on controls at a service organization relevant to internal control over financial reporting.
- SOC 3: A general-use report addressing the Trust Services Criteria with less detail than a SOC 2 report.
- Internal Controls: Policies and procedures established to manage risks and support organizational objectives.
- Access Control: Security measures that determine who can access systems, applications, networks, or information.
- Identity and Access Management (IAM): Processes and technologies used to manage digital identities and control access to resources.
- Third-Party Risk Management: The process of identifying and managing risks associated with external vendors and service providers.
- Vendor Risk Assessment: An evaluation of a vendor’s security, privacy, operational, and compliance practices.
- Security Monitoring: Continuous observation of systems and activity to identify events that may require investigation or response.
- Incident Response: Processes used to detect, investigate, contain, and respond to security incidents.
- Risk Assessment: A structured process for identifying risks, evaluating their potential impact, and determining appropriate controls.
- Data Protection: Measures used to protect information against unauthorized access, alteration, disclosure, loss, or destruction.
- Confidentiality: Protection of information from unauthorized access or disclosure.
- Availability: The ability of systems and services to remain accessible and operational according to defined requirements.
- Processing Integrity: The principle that system processing is complete, valid, accurate, timely, and authorized.
- Privacy: The appropriate handling of personal information throughout its collection, use, retention, disclosure, and disposal.
- Control Testing: The examination of controls to determine whether they are appropriately designed and operating as intended.
- Audit Evidence: Information used by an auditor to support conclusions reached during an examination.
- Continuous Compliance: An approach that uses ongoing monitoring and evidence collection to maintain visibility into compliance-related controls.
- Cloud Security: Practices and controls used to protect cloud infrastructure, applications, workloads, and data.
- Data Security: The protection of data from unauthorized access, modification, disclosure, or destruction.
- Information Security: Policies, processes, and technologies used to protect information and information systems.
