# SOC 2 report

An attestation report in which a licensed CPA firm gives its opinion on a service organisation's controls against the Trust Services Criteria.

Source: https://sted.digital/docs/glossary/soc-2-report · Last reviewed 17 October 2026 · Strand Glossary

A SOC 2 report is an attestation report in which a licensed CPA firm gives its opinion on a service organisation's controls, measured against the AICPA's Trust Services Criteria. Your customers' security and procurement teams read it to decide whether to trust you with their data, and nobody issues a certificate.

## Where the term appears

The American Institute of Certified Public Accountants (AICPA) defines the report and its contents. Every SOC 2 report holds the auditor's opinion, a written assertion signed by your management, your system description and, for a Type II report, the tests the auditor ran and what they found. The [Type I and Type II](/docs/standards/soc-2/type-1-vs-type-2) split is about time: Type I covers the design of your controls at one date, Type II covers how they operated across a period.

### Attestation, not a certificate

Buyers' security teams notice the wording. You have a SOC 2 Type II report; you are not "certified". An unqualified opinion is the one customers want. A qualified opinion means at least one criterion was not met, while a single exception in the tests does not always lead to one. The report is for restricted use, so most organisations share it under a non-disclosure agreement; the shorter SOC 3 report is the version meant for anyone.

## How Sted uses it

Sted treats SOC 2 as committed when you hold a report, are preparing for one or a customer requires it, and as recommended when Sted's benefit assessment says so and you run a service (software, data, payments, an AI system, or a product with availability, processing or confidentiality commitments); report type and trust services categories are later questions.
Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
Audit readiness is visible to administrators only for now.

Sted does not attest to your controls or appoint your auditor. Only a licensed CPA firm can issue and sign a SOC 2 report.

## Related terms

- [Trust Services Criteria](/docs/glossary/trust-services-criteria): the criteria the report measures your controls against.
- [Control](/docs/glossary/control): what the auditor tests, one at a time.
- [Evidence](/docs/glossary/evidence): what the auditor samples across a Type II period.
- [Certification audit](/docs/glossary/certification-audit): often confused with it. An ISO 27001 audit ends in a certificate; a SOC 2 examination ends in an opinion.
- [Certification body](/docs/glossary/certification-body): the ISO counterpart of the CPA firm, which SOC 2 does not use.