SOC 2

SOC 2 is an attestation report, not a certificate. A licensed CPA firm examines your controls against the AICPA’s Trust Services Criteria and gives an opinion: on their design at one date (Type I) or on how they operated over a period (Type II). US enterprise customers ask for one before they trust a supplier with their data.

What it is and who it applies to

A SOC 2 report belongs to the AICPA’s family of SOC reports. SOC 1 covers controls that matter to a customer’s financial reporting; SOC 2 covers controls over security, availability, processing integrity, confidentiality and privacy; SOC 3 is a short general-use version of SOC 2. The American Institute of Certified Public Accountants (AICPA) owns the framework.

The criteria are the 2017 Trust Services Criteria, published with revised points of focus in 2022. The criteria themselves did not change in 2022; the points of focus are illustrative characteristics that help you and your auditor judge whether a control meets a criterion, and you do not have to address every one. A second AICPA text, the 2018 SOC 2 description criteria, sets what your system description must say.

SOC 2 is built for a service organisation: a business whose customers rely on a service it runs for them, such as software they use, data it hosts or transactions it processes. No law requires it. It applies when a customer, a procurement team or an investor asks for it, which happens most often to UK software companies selling into the US.

Security is in every SOC 2 report. Availability, Confidentiality, Processing Integrity and Privacy are optional, and you choose them engagement by engagement.

SOC 2 or ISO 27001?

Both answer the same customer question, “can we trust you with our data?”, in different ways. ISO 27001 certifies that you run an information security management system, and a certification body issues a certificate that anyone may see. SOC 2 reports on whether specific controls met the criteria, in a detailed document a customer reads under a non-disclosure agreement. US buyers tend to ask for SOC 2; UK and European buyers tend to ask for ISO 27001. If your customers are on both sides of the Atlantic, you may end up with both, and the second costs far less effort than the first.

This is guidance to help you understand the requirement, not legal advice.

Structure

The Trust Services Criteria are grouped into series. Security is the 33 common criteria in nine series, CC1 to CC9. The first five follow the 17 principles of the COSO 2013 internal control framework; CC6 to CC9 add the IT-specific ground. The optional categories add three availability criteria, two confidentiality criteria, five processing integrity criteria and eight privacy series. The table paraphrases each series; the criteria’s own wording is not reproduced.

Certification and enforcement

Nothing is certified, and no certificate exists. A SOC 2 examination is an attestation engagement carried out by a licensed CPA firm under the AICPA’s attestation standards, using the AICPA guide on SOC 2 reporting. The firm’s opinion covers your system description and your controls against the categories you chose. Only a CPA firm can sign the report; a readiness consultant or a software platform can prepare you, but cannot issue it.

There are two report types. A Type I report gives an opinion on whether your controls were suitably designed at a single date. A Type II report adds an opinion on whether they operated effectively throughout a period, with the auditor’s tests and results. The AICPA sets no minimum period; first periods are often three to six months, and renewals usually run for 12 months back to back.

A report contains the auditor’s opinion, a written assertion from your management, your system description and, for Type II, the tests. An unqualified opinion is the one customers want. A qualified opinion means at least one criterion was not met; individual exceptions in the tests do not always lead to one.

SOC 2 reports are restricted-use documents. You share them with customers and prospects, usually under a non-disclosure agreement. Between reports, your management can issue a bridge letter covering the time since the last period ended.

No regulator enforces SOC 2. Your contracts do: a customer may require a current Type II report each year. The AICPA and US state boards of accountancy oversee the CPA firms themselves, and in 2026 the AICPA publicly warned about quick-turn SOC engagements and providers who are unlicensed or outside peer review.

How the pieces fit

A SOC 2 report is the end of a chain. You describe the system in scope and choose the categories. You put controls in place that meet the criteria, and the controls produce evidence as they run: access reviews, change tickets, incident records, supplier reviews. A readiness assessment finds the gaps before the clock starts. For Type II, the observation period is the stretch of time the auditor will test. The audit samples that evidence, the report states the opinion, and the next period starts at once, so the evidence never stops.

Most findings trace back to the middle of the chain: a control that exists on paper but left no evidence during the period.

In this section

• SOC 2 security and the common criteria: what do the nine series CC1 to CC9 ask for?
• SOC 2 Type I and Type II reports: which report do you need, and how long is the period?
• SOC 2 evidence: what does an auditor sample, and how do you keep it ready?
• Working with your SOC 2 auditor: how do you choose a firm and what do you write yourself?
• SOC 2 availability criteria: what does A1 add for uptime commitments?
• SOC 2 confidentiality criteria: how do you protect and dispose of confidential information?
• SOC 2 processing integrity criteria: when does PI1 belong in your report?
• SOC 2 privacy criteria: how does the privacy category differ from GDPR?

How Sted maps it

SOC 2 is one of the standards, regulations and schemes in Sted’s catalogue.

Sted treats SOC 2 as committed when you already hold a report, are preparing for one or a customer requires it. It recommends SOC 2 when its benefit assessment says so and you run a service: software, data, payments, an AI system, or a product with availability, processing or confidentiality commitments. The report type and the categories are questions for later. Sted explains each recommendation on the Standards page, and you select the standard or remove it.

Selecting it and pressing Update and generate framework builds the documents. For SOC 2, Sted’s knowledge base carries 33 policies and procedures and 61 record templates tagged to the criteria, drawn from the wider knowledge base and drafted for your organisation for you to review. Sted’s SOC 2 catalogue holds the privacy category as eight series-level rows rather than individual criteria, with no policy or record template mapped to them yet.

Many SOC 2 criteria cover the same ground as ISO 27001 Annex A controls, so an organisation pursuing both can run one set of controls for the two. Sted does not collect evidence from your systems: you record it.

The SOC 2 criteria get their own Statement of Applicability card, and your progress per standard shows in audit readiness. The evidence an auditor samples is kept in Records, each one following a template with sections and structured fields.

Frequently asked questions