SOC 2
Also known as: Service Organization Control 2, SOC 2 Type II, SOC2
SOC 2 (System and Organization Controls 2, originally Service Organization Control 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA) to evaluate how service organizations manage customer data against five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Only Security is mandatory; organizations choose which additional criteria to include. A SOC 2 Type II report, which usually covers six to twelve months, has become the de facto proof-of-security that enterprise customers demand before sharing sensitive data with a vendor.
SOC 2, explained at three levels
At home
When a company stores your data (a payroll service holding your salary details, a cloud storage app holding your files) SOC 2 is one way they prove to your employer that they are handling it responsibly. A SOC 2 report is essentially an independent auditor's verdict on whether a company's security controls are real and working. Seeing 'SOC 2 Type II' means an outside auditor checked their systems over a period of months (often six to twelve), not just on one day.
At work
SOC 2 is the most common security assurance document requested during enterprise vendor procurement. A Type I report confirms that controls are designed appropriately at a point in time; a Type II report confirms that those controls operated effectively over a period, usually six to twelve months, which is far more meaningful. When reviewing a vendor's SOC 2 report, check the coverage period, the scope of systems tested, and whether any exceptions were noted: a clean report with a narrow scope is not the same as a comprehensive one.
At home
The five Trust Service Criteria are: Security (CC criteria: the mandatory baseline covering logical access, change management, and risk management), Availability (uptime and performance), Processing Integrity (complete and accurate processing), Confidentiality (protection of confidential data), and Privacy (AICPA's privacy principles for personal information). Most SaaS vendors include Security and Availability. The scope section of any SOC 2 report defines exactly which systems were tested: out-of-scope systems are not covered.
At work
The SOC 2 audit is conducted by a licensed CPA firm. Preparation typically takes three to six months: implementing missing controls, gathering evidence (log exports, configuration screenshots, policy documents, ticket records), and completing a readiness assessment. Many organizations use a compliance platform (Vanta, Drata, Secureframe) to automate evidence collection. A Type II report covers a 6-12 month observation window; a 12-month window is increasingly expected by enterprise customers.
At home
The Common Criteria (CC) section of the Security TSC covers the control environment, risk assessment, control activities, information and communication, and monitoring. CC6 (Logical and Physical Access Controls) is where most audit findings appear. Key controls tested include MFA enforcement, least-privilege access reviews, employee onboarding and offboarding procedures, vendor access management, and encryption key management.
At work
From a practitioner standpoint, the biggest risk in a SOC 2 audit is control gaps discovered during the observation period: unlike readiness assessments, the Type II period captures actual control failures. Continuous control monitoring is now standard practice: automated checks on MFA coverage, access review completion rates, and encryption configuration run daily. The SOC 2 + ISO 27001 combined report is increasingly common for vendors serving regulated industries, combining frameworks into a single audit to reduce customer due diligence burden.
Real-world examples
At home
Jerome's small HR software company was told by a prospective enterprise client that they needed a SOC 2 Type II report before signing the contract. Jerome worked with a compliance platform to implement missing controls (including enforcing MFA and quarterly access reviews) and completed the six-month observation period before the audit.
At work
The procurement team at Northgate Financial Services added SOC 2 Type II as a mandatory vendor requirement after a third-party data breach. The security team created a standard vendor review checklist that maps SOC 2 CC controls to Northgate's internal risk appetite, flagging any report with exceptions in the CC6 access control category for escalation.
How it compares
| Feature | SOC 2 | ISO 27001 | PCI DSS |
|---|---|---|---|
| Who issues it | Licensed CPA firm | Accredited certification body | Qualified Security Assessor (QSA) or self-assessment |
| Output document | Attestation report (Type I or Type II) | ISO 27001 certificate | SAQ or Report on Compliance (ROC) |
| Mandatory? | No: customer-driven | No: voluntary | Yes, for card payment acceptance |
| Observation period | Type II: 6-12 months | Annual surveillance audits | Annual |
| Geographic prevalence | Strongest in North America | Global | Global (card industry) |
SOC 2 is the preferred assurance standard in North American B2B SaaS procurement. ISO 27001 is more recognized globally and in regulated industries. PCI DSS is mandatory only for organizations handling card payments.
For analysts
In BA artefacts, SOC 2 requirements typically surface as vendor selection criteria and non-functional requirements for third-party integrations. When writing requirements for systems hosted by third-party providers, specify which Trust Service Criteria and coverage period are required. Document the expected report review process, who reviews it, how exceptions are escalated, and how often the report must be refreshed. Avoid treating a SOC 2 report as a permanent credential; reports expire and control environments change between audits.
History & origin
SOC 2 grew out of the older SAS 70 auditing standard, which was designed for financial controls and became widely misused as a generic security credential. In 2011 the AICPA replaced SAS 70 with the SOC framework: SOC 1 for financial reporting controls and SOC 2 for data security and operations. The Trust Service Criteria were revised in 2016 and again in 2017 to align with modern cloud and SaaS environments. SOC 2 is now the most commonly requested security attestation in B2B SaaS procurement, particularly in North America.