SOC 1 asks whether a service organization’s controls support reliable financial reporting by its customers. For example, a payroll provider’s processing can affect a customer’s payroll expense figures. SOC 2 asks about controls over the service system, such as protecting data or meeting availability commitments, within the categories examined. A hosted application may therefore be asked for SOC 2 even when it does not feed financial statements. The same provider can need both: the deciding factor is the customer’s assurance question, not the provider’s industry label.
Are the proposed 2027 SOC 2 criteria final requirements?
No. As of October 30, 2026, the AICPA's proposed 2027 Trust Services Criteria and Description Criteria are exposure drafts, not final requirements. The announced comment deadline is January 15, 2027.
