SOC 2
AICPA attestation report covering how a service organization handles customer data.
SOC 2 (Service Organization Control 2) is an attestation performed by a licensed CPA firm against the AICPA's five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Type 1 reports the design of controls at a point in time. Type 2 reports on the operating effectiveness of those controls over a window — usually 3 to 12 months. Enterprise buyers commonly require Type 2 before signing.
SOC 2 is US-centric and does not certify — it produces a report you share under NDA with prospects and customers.
What to look for in a SOC 2 report
Start with the service description, system boundaries, report period, and criteria in scope. A report for one product or hosting environment may not cover the service you actually buy. Read the auditor’s opinion and any exceptions, then check the complementary user entity controls: these describe security responsibilities that remain with your own organization.
A practical review example
If a payroll vendor provides a report, compare its covered systems with the payroll service in your contract. Ask who handles access approvals, exports, and incident notification. Record the report date, reviewer, relevant exceptions, and follow-up decisions rather than simply marking the vendor as compliant.
What the report cannot establish
SOC 2 is not a guarantee against breaches and does not establish that your business meets every legal requirement. A report’s usefulness depends on its scope and age. Treat it as evidence for a specific decision, alongside contractual terms and your own controls, not as a substitute for due diligence.
Related terms
See how Scarlet Risk covers SOC 2.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo