SOC 2 covers security, and optionally availability, processing integrity, confidentiality and privacy. It is the report US enterprise buyers most often ask their software and service providers for, and it is shared under NDA because it describes controls and test results in detail.
A SOC 2 is not a certification: the output is an auditor's report with an opinion, issued as a Type 1 or a Type 2. The SOC 2 guide covers the whole process.
Read more
Related terms
- Trust Services Criteria
- The Trust Services Criteria are the AICPA criteria a SOC 2 measures controls against: Security, Availability, Processing Integrity, Confidentiality and Privacy.
- SOC 2 Type 2
- A SOC 2 Type 2 report gives an auditor's opinion on whether controls were suitably designed and operated effectively throughout a review period.
- SOC 1
- SOC 1 is a CPA firm's report on a service organization's controls that are relevant to its customers' internal control over financial reporting.
- SOC 3
- SOC 3 is a general-use summary of a SOC 2 examination, with the auditor's opinion and a short system description but no detailed tests or results.
- ISAE 3000
- ISAE 3000 is the IAASB's international standard for assurance engagements on subject matter other than historical financial information.