What is SOC 2?
A SOC 2 report helps customers understand the controls behind your service. Start by agreeing on the system in scope, the report type, and the Trust Services categories that matter to the engagement.
Find what you need
- Scope: define the system boundary
- Preparation: work through the SOC checklist
- Evidence: understand what makes a useful record
- Report choices: compare SOC 1, SOC 2 and report types
On this page: How reporting works · Trust Services Criteria · Changes and timeline · FAQs · Ask for assistance
How SOC 2 reporting works
The System and Organization Controls (SOC) 2 Report will be performed in accordance with AT-C 205 and based upon the Trust Services Criteria, with the ability to test and report on the design (Type I) and operating (Type II) effectiveness of a service organization’s controls (just like SOC 1). The SOC 2 report focuses on a business’s non-financial reporting controls as they relate to security, availability, processing integrity, confidentiality, and privacy of a system, as opposed to SOC 1 which is focused on the financial reporting controls.
Many entities outsource tasks or entire functions to service organizations that operate, collect, process, transmit, store, organize, maintain and dispose of information for user entities. SOC 2 was put in place to address demands in the marketplace for assurance over non-financial controls to prevent SOC 1 from being misused just like SAS 70 was.
What are the Trust Services Criteria?
The Trust Services Criteria are the benchmarks used to evaluate controls in a SOC 2 examination. They cover five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Your controls are the policies and activities you put in place to meet the applicable criteria. Points of focus help explain the criteria; they are not a separate checklist every organization must satisfy item by item.
The five categories, in plain language
The diagram above uses older terminology. This readable summary follows the AICPA’s 2017 Trust Services Criteria with revised points of focus (2022).
- Security: Protect systems and data from unauthorized access, disclosure, and damage.
- Availability: Keep systems and information usable as needed to meet the organization’s objectives.
- Processing integrity: Check that processing is complete and accurate, valid and authorized, and finished on time.
- Confidentiality: Protect information the organization has designated as confidential.
- Privacy: Manage how personal information is collected, used, kept, shared, and disposed of in line with the organization’s privacy objectives.
A SOC 2 report does not necessarily cover all five categories. Check the categories and system boundaries in the report; agree the intended scope with your auditor.
Further reading: AICPA: 2017 Trust Services Criteria with revised points of focus (2022).
Changes to SOC 2
AICPA publishes the 2017 Trust Services Criteria with revised points of focus (2022). Use that source when planning the examination, and agree the applicable criteria and system scope with your auditor. The revised points of focus provide additional context for areas such as:
- an environment of ever-changing technologies, threats and vulnerabilities, and other matters that may create additional risks to organizations.
- addressing changing legal and regulatory requirements and related cultural expectations regarding privacy.
- addressing data management (for example, data storage, backup, and retention), particularly when related to confidentiality.
- differentiating which points of focus related to privacy may apply only to an organization that is a data controller or only to an organization that is a data processor, as defined in the glossary. (Although this distinction is intended to assist management and the practitioner in identifying situations in which certain points of focus may be particularly relevant, the specific facts and circumstances of the organization’s operations should be considered when identifying and applying points of focus in a trust services engagement.)
SOC 2 Change Timeline
Further, beyond attesting to the SOC 2 Criteria and Categories, there are mappings to other relevant frameworks that can be included and addressed within a SOC 2 report to make it more flexible and useful to Organizations. Click the following link to learn more about the SOC2+ Additional Subject Matter and how it can be leveraged to reduce overall compliance costs and efforts.
The report covers the categories and system agreed for the examination, not necessarily all five categories. SaaS providers, data centers and other service organizations should choose scope based on their services and customer needs.
