SOC 2
An independent audit report on how a service provider protects customer data, based on criteria set by the American Institute of CPAs (AICPA).
In short
- A Type I report describes controls at a point in time; a Type II report tests whether they worked over a period.
- Security is always in scope. Availability, processing integrity, confidentiality and privacy are optional.
- It is a report you read, not a certificate. The exceptions section matters.
SOC 2, short for System and Organization Controls 2, is an attestation report issued by an independent CPA firm. It evaluates a service organization's controls against the AICPA's Trust Services Criteria. Software and cloud providers use it to show customers how they protect data.
The Trust Services Criteria
- Security: protection against unauthorized access. Always included.
- Availability: systems are available as committed.
- Processing integrity: processing is complete, accurate and authorized.
- Confidentiality: confidential information is protected.
- Privacy: personal information is handled according to commitments.
Type I and Type II
A Type I report assesses whether controls are suitably designed at a specific date. A Type II report also tests whether they operated effectively over a period, usually six to twelve months. Type II is what most customers ask for, because it shows the controls actually worked, not just that they exist on paper.
Reading a SOC 2 report
The report includes the auditor's opinion, a description of the system, the controls tested and the results. The most useful sections are the scope, to confirm it covers the service you use; any exceptions, where a control failed a test; and the complementary user entity controls, which list what you, as the customer, are expected to do on your side.
Worked example
A vendor review
A controller reviewing a new AP automation vendor receives its SOC 2 Type II report covering January to December. The opinion is unqualified, security and availability are in scope, and there is one exception: two terminated employees kept access for more than the policy's 24 hours. The vendor's response shows the process was fixed. The controller notes the user controls, such as reviewing their own users quarterly, and approves the vendor.