SOC 2 report
A SOC 2 report is an attestation report in which a licensed CPA firm gives its opinion on a service organisation’s controls, measured against the AICPA’s Trust Services Criteria. Your customers’ security and procurement teams read it to decide whether to trust you with their data, and nobody issues a certificate.
Where the term appears
The American Institute of Certified Public Accountants (AICPA) defines the report and its contents. Every SOC 2 report holds the auditor’s opinion, a written assertion signed by your management, your system description and, for a Type II report, the tests the auditor ran and what they found. The Type I and Type II split is about time: Type I covers the design of your controls at one date, Type II covers how they operated across a period.
Attestation, not a certificate
Buyers’ security teams notice the wording. You have a SOC 2 Type II report; you are not “certified”. An unqualified opinion is the one customers want. A qualified opinion means at least one criterion was not met, while a single exception in the tests does not always lead to one. The report is for restricted use, so most organisations share it under a non-disclosure agreement; the shorter SOC 3 report is the version meant for anyone.
How Sted uses it
- Sted treats SOC 2 as committed when you hold a report, are preparing for one or a customer requires it, and as recommended when Sted’s benefit assessment says so and you run a service (software, data, payments, an AI system, or a product with availability, processing or confidentiality commitments); report type and trust services categories are later questions.
- Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
- Audit readiness is visible to administrators only for now.
Sted does not attest to your controls or appoint your auditor. Only a licensed CPA firm can issue and sign a SOC 2 report.
Related terms
- Trust Services Criteria: the criteria the report measures your controls against.
- Control: what the auditor tests, one at a time.
- Evidence: what the auditor samples across a Type II period.
- Certification audit: often confused with it. An ISO 27001 audit ends in a certificate; a SOC 2 examination ends in an opinion.
- Certification body: the ISO counterpart of the CPA firm, which SOC 2 does not use.