CC1–CC5
COSO-based foundations
Control environment, communication and information, risk assessment, monitoring activities and control activities — the governance layer the criteria take from the COSO internal control framework.
AICPA SOC 2® examination
SOC 2 compliance
What a SOC 2 report is and is not, the criteria it tests, how the audit cycle runs, and what decides how long it takes and what it costs.
SOC 2 is an attestation report, not a certification. A licensed CPA firm examines a service organisation's description of its system and the controls behind it against the AICPA's Trust Services Criteria, and gives an opinion on them. Security — the common criteria, CC1 to CC9 — is in every SOC 2 report; availability, processing integrity, confidentiality and privacy are added when they matter to your customers. A Type 1 report covers whether controls are suitably designed at a point in time; a Type 2 report also covers whether they operated effectively over a period, commonly three to twelve months. The report is restricted-use: you share it with customers and prospects, usually under NDA, rather than publish it.
Key takeaways
- SOC 2 is an attestation, not a certification: the output is a CPA firm's opinion in a report, not a certificate against a standard.
- Security (the common criteria) is mandatory; availability, processing integrity, confidentiality and privacy are chosen to match what you promise customers.
- Type 1 tests design at a date; Type 2 tests design and operating effectiveness across a period, and is the report most customers ask for.
- No law requires SOC 2. Customers do — most often in North America, increasingly in European enterprise procurement.
- Cost is driven by the criteria and system in scope, the length of the observation period, the readiness gap, and the auditor you choose.
Scope
Who SOC 2 applies to
SOC 2 has no legal scope. Your customers ask for it, and you decide which system and which criteria the report covers.
- Service organisations — SaaS, cloud, data processing and managed services — whose systems hold or affect their customers' data.
- The system in scope is yours to describe: the services, infrastructure, software, people, procedures and data behind them. The report's system description is part of what the auditor opines on.
- Subservice organisations such as your cloud provider are usually carved out: the report relies on their own SOC reports and lists the controls it expects them to run.
- Complementary user entity controls are the ones the report assumes your customers operate — managing their own user access, for example.
- SOC 1 covers controls relevant to customers' financial reporting instead; SOC 3 is a short general-use version of a SOC 2 you can publish.
Requirements
What SOC 2 requires
Nine series of common criteria apply to every report; four further categories are added by choice. Each card links to the guide that covers it in depth.
CC6
Logical and physical access
Provisioning and removing access, authentication, periodic access review, encryption and protection against unauthorised access.
CC7
System operations
Detecting vulnerabilities and anomalies, monitoring, and responding to and recovering from security incidents.
CC8
Change management
Authorising, designing, testing and approving changes to infrastructure, data and software before they reach production.
CC9
Risk mitigation
Business disruption risk, and the risk from vendors and business partners — supplier assessment and monitoring.
A1 · PI1 · C1 · P
Additional categories
Availability, processing integrity, confidentiality and privacy criteria, included when your service commitments make them relevant.
Type 1 · Type 2
Report type
Type 1 reports on design at a date. Type 2 adds operating effectiveness across an observation period, which means the controls have to leave evidence the whole time.
Timeline
The audit cycle
SOC 2 has no statutory dates. The cycle below is the usual shape of a first Type 2 and the years after it; the lengths are typical, not prescribed.
- ReadinessChoose the criteria and system in scope, and close design gaps — often with a readiness assessment
- Type 1 dateOptional first report: controls tested for suitable design at a single date
- 3–12 monthsType 2 observation period, during which controls must operate and leave evidence
- FieldworkThe auditor samples evidence across the period, then issues the report
- Every 12 monthsThe next period, so reports cover back-to-back periods without gaps
Overlaps
How it fits with other frameworks
SOC 2 rarely arrives alone. Where it meets the other regimes you probably already run.
ISO 27001
Most Trust Services Criteria have an Annex A counterpart, so one control set and one evidence base can carry both. ISO 27001 adds the management system clauses; SOC 2 adds an auditor's opinion on your own system description.
GDPR
The privacy criteria overlap with GDPR principles, and a Type 2 is good evidence for Article 32 security. A SOC 2 report is not a GDPR compliance statement, and supervisory authorities do not treat it as one.
DORA
Financial customers can use a supplier's Type 2 report in ICT third-party due diligence. It does not replace the Article 30 contract terms or their own register of information.
NIS2
In-scope customers must secure their supply chain under Article 21(2)(d), and a SOC 2 report is one of the answers they accept. It says nothing about your own NIS2 obligations if you are in scope yourself.
On Noru
How Noru runs SOC 2
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
SOC 2 on the shared control library
SOC 2 is one of the frameworks you switch on, mapped to the same controls as ISO 27001 with its own criteria references — the quarterly access review that answers CC6.2 and CC6.3 also answers A.5.18.
Evidence that builds up across the period
Evidence is collected continuously from connected systems and versioned, so a Type 2 observation period builds a dated record as it runs instead of screenshots gathered the week before fieldwork.
Vendors and findings in the same programme
The vendor register, supplier questionnaires and evidence answer CC9; vulnerabilities and pen-test findings are tracked to resolution and linked to risk, which is what CC7 asks you to show.
One package per period
Framework status reads from the live programme, and the audit package for SOC 2 and a given period bundles controls, evidence, policies and milestones for your auditor.
Is SOC 2 required for companies selling in Europe?
No law requires it. European buyers more often ask for ISO 27001, but a SOC 2 Type 2 is common in deals with North American customers and US-headquartered enterprises, and many European software companies hold both from one control set.
How long is a SOC 2 report valid?
A report has no formal expiry: it describes a period that has already ended. In practice customers want a period that ended within the last twelve months, so most organisations run back-to-back annual periods and cover the time since the last one with a bridge letter.
What is a SOC 3 report?
A general-use report on the same examination, with the auditor's opinion and a summary of the system but without the detailed description of controls and tests. Because it is not restricted, you can publish it — on a trust page, for example — while the SOC 2 report itself goes out under NDA.
What are complementary user entity controls?
Controls the report assumes your customers operate for the criteria to be met — managing their own users' access to your product, for example. They are listed in the report, and a customer relying on it should check that they actually run them.
Primary sources
Regulatory references on this page were last checked on .
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022), AICPA & CIMA
- SOC 2® — Reporting on an Examination of Controls at a Service Organization (AICPA guide), AICPA & CIMA
- System and Organization Controls: SOC suite of services, AICPA & CIMA
See where you stand
A 45-minute walkthrough of SOC 2 against your own controls, integrations and evidence.