SOC 2
An audit report on a service company's controls for security and related areas.
SOC 2 is a report, defined by the AICPA, on an examination of a service organisation's controls relevant to security, availability, processing integrity, confidentiality or privacy. An independent auditor examines the controls and writes the report.
A Type I report looks at how controls are designed at one point in time; a Type II report also tests whether they operated effectively over a period. B2B buyers often ask for a SOC 2 report before they sign.
Key characteristics
- An audit report, not a certificate.
- Covers security, availability, processing integrity, confidentiality or privacy.
- Type I: design at a point in time. Type II: operation over a period.
- Often requested by B2B buyers.
Example
A startup selling to enterprises completes a SOC 2 Type II examination and lists it on its trust page, with the report shared under NDA.
Go deeper
Frequently asked questions
Is SOC 2 a certification?
Not strictly. It is an auditor's report on your controls; companies often describe passing it as being SOC 2 compliant.
Related terms