Draft
What is SOC 2?
By The Citesheet team · Published
Short answer
SOC 2 is a report from an independent CPA firm on a service organization's controls, under criteria set by the AICPA. It covers security and can also cover availability, processing integrity, confidentiality and privacy. A Type 1 report looks at controls at one point in time; a Type 2 report tests whether they worked over a period, commonly 6 to 12 months. Many buyers ask for it, but a questionnaire can be answered honestly without one.
SOC 2 is a report on a service organization's controls, written by an independent CPA firm. It belongs to the AICPA's System and Organization Controls (SOC) family of reports, which CPAs provide so customers can assess the risks of outsourcing to a service provider.
What it covers
A SOC 2 report addresses one or more of five categories: security, availability, processing integrity, confidentiality and privacy.
Type 1 vs Type 2
- Type 1: are the controls suitably designed, at a single point in time?
- Type 2: did the controls actually operate effectively over a period, generally 6, 9 or 12 months?
Buyers often ask for Type 2, which is why a young company often can't have one yet: the observation period has to pass first.
SOC 2 and questionnaires
A SOC 2 report doesn't replace a security questionnaire, but it makes one easier. Many buyers accept "see our SOC 2 report" for parts of a CAIQ or SIG. Without one, you answer the questions directly from your policies and practices. "SOC 2 compliant" is not a substitute for a report: if you haven't been examined, say No and describe what you have. Our guide on answering without SOC 2 has sample wording.