System and Organization Controls 2 (SOC 2)
SOC 2 is how service organizations prove to customers that their controls over customer data actually work. It's an attestation framework: a licensed Certified Public Accountant (CPA) firm examines your controls against the Trust Services Criteria and issues a report your customers can read, including the auditor's opinion and any exceptions.
Who Needs It
Nobody is legally required to have a SOC 2 report. You need one when your customers do, and for SaaS companies, cloud and managed service providers, data centers, and anyone processing customer data on others' behalf, that moment usually arrives with the first enterprise deal, when procurement asks for your SOC 2 report as part of a security review.
That makes SOC 2 the default first framework for US-market B2B companies: it's what buyers' vendor risk teams are trained to ask for.
Trust Services Criteria
A SOC 2 examination covers one or more of five Trust Services Criteria. You and your auditor agree on scope before the audit period begins:
| Criteria | Required? | What it covers |
|---|---|---|
| Security | Yes, every SOC 2 | Protection against unauthorized access and disclosure; the "Common Criteria" (CC-series) |
| Availability | Optional | Uptime commitments, disaster recovery, business continuity |
| Processing Integrity | Optional | Complete, accurate, timely, authorized processing |
| Confidentiality | Optional | Protection of information designated confidential |
| Privacy | Optional | Collection, use, retention, and disposal of personal information |
Security is mandatory; the rest are added based on what you promise customers. Most companies start with Security alone or Security plus Availability, and add Confidentiality when contracts demand it. We recommend against scoping in Privacy casually because it's the heaviest criteria and often better served by dedicated privacy work.
A few signals help decide whether an optional criteria belongs in scope. Availability earns its place when contracts or SLAs carry uptime commitments and a disruption would materially affect customers. Confidentiality fits when you hold customer intellectual property or information covered by NDAs, where unauthorized disclosure would cause financial or competitive harm. Processing Integrity fits when your system performs calculations, transformations, or transactions where errors would create financial, legal, or operational risk for customers. And note that a Privacy examination does not substitute for compliance with privacy regulations such as General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), or Health Insurance Portability and Accountability Act (HIPAA); it attests to your controls over personal information, not your regulatory standing.
The criteria are built on the COSO internal control framework, which is why a SOC 2 audit examines your whole control environment (governance, risk assessment, communication, monitoring), not just technical safeguards. Under each criterion, the AICPA publishes points of focus: guidance on what a control meeting the criterion might look like. They are guidance rather than requirements: you don't have to satisfy every point of focus, and auditors evaluate your controls against the criteria themselves.
Type 1 vs Type 2
There are two report types:
- A Type 1 report says your controls were suitably designed at a point in time. It's a snapshot, useful as a fast first milestone.
- A Type 2 report says your controls were designed suitably and operated effectively over a period, typically 3 to 12 months. The auditor samples evidence across the whole window.
The evidence burden differs accordingly. A Type 1 mostly needs point-in-time proof such as policies and configuration screenshots, while a Type 2 involves the auditor sampling logs, tickets, and records across the whole period, so preparation and fieldwork take longer.
Enterprise customers almost always want Type 2. A common path: complete a Type 1 to show early progress, open the Type 2 observation window immediately, and deliver the Type 2 after the first period closes. Some organizations skip the Type 1 and go straight to Type 2, which avoids paying for two separate audits; the trade-off is a longer wait before you have any report to show. Repeating Type 1 audits year after year is uncommon and rarely satisfies customers as your business grows.
For the artifacts that typically satisfy manually evidenced control areas, see Example Evidence.
FAQ
What happens after we submit evidence?
The audit team reviews each item against the control it supports. For each control they either accept the evidence and move on, come back with questions and requests for additional information, or write up a finding. Deviations appear in the report alongside the affected controls under "results of service auditor's test of controls," either as "no exceptions noted" or with the reason the control failed. Enough deviations result in a qualified, disclaimer, or adverse opinion, which is why internal evidence review before submission matters.
Is SOC 2 a certification?
No, it's an attestation. A CPA firm issues an opinion on your controls, and you receive a report rather than a certificate. That is also why claims of being "SOC 2 certified" are technically inaccurate.
How long is a report valid?
Reports don't technically expire, but customers expect a Type 2 report covering a period ending within the last 12 months. Most companies run back-to-back annual audit periods, and use a bridge letter to cover the gap between the period end date and today.
Type 1 or Type 2: which do we actually need?
Ask your customers, but expect the answer to be Type 2. Type 1 buys credibility while your first Type 2 period runs; it rarely satisfies enterprise procurement on its own.
How long does the audit period have to be?
Type 2 periods typically run 3 to 12 months. First-timers often choose 3 or 6 months to get a report in hand sooner, then move to annual 12-month periods.