Auditors test controls in defined stages, and each stage expects specific kinds of evidence. Testing will occur for the different criteria and controls that have been implemented by the service organization. For example, the testing and evidence for availability will be different than that of privacy.
Your System and Organization Controls 2 (SOC 2) is only valid for a year after your audit. If you’re behind on renewing your SOC 2 report and it falls past the date in which it’s valid, you may need a SOC 2 bridge letter. The letter maintains trust with your customers while you renew the report.
Answers to the questions we hear most often about System and Organization Controls 2 (SOC 2): whether it is required, how the attestation works, and what the process costs in time and money.
Comprehensive guide to SOC 2 compliance including Trust Services Criteria, AICPA framework, implementation timeline, costs, and audit requirements for service organizations