Framework Information Security & Privacy
SOC 2 is the AICPA's examination of a service organization's controls against the Trust Services Criteria for security (required in every report), availability, processing integrity, confidentiality and privacy. The current criteria are the 2017 Trust Services Criteria with revised points of focus issued in 2022.
A licensed CPA firm examines the organization's system description and controls and issues a report that is restricted to customers, prospects under NDA and their advisers. It has become the default assurance document for SaaS and cloud vendors selling to businesses.
A Type 1 report covers the design of controls at a point in time; a Type 2 report covers design and operating effectiveness over a period, commonly three to twelve months.
To get either, the organization must produce a system description that meets the AICPA description criteria, a management assertion, and a set of written policies and control activities mapped to each criterion in scope.
The auditor tests against those documents, so policies for access, change management, vendor management, incident response, risk assessment, business continuity and data handling need to exist and be followed.
Voluntary and contractual. Technology and outsourced service providers obtain SOC 2 because customer security reviews, procurement policies and contracts require it; there is no legal mandate.
System description and management assertion; trust services categories in scope; policy set (information security, access control, change management, incident response, vendor management, business continuity, data classification and retention, acceptable use); risk assessment; control matrix mapped to criteria; populations and samples for user access, changes, incidents, vendors and hires; monitoring evidence (vulnerability scans, logging, backups, availability metrics); subservice organization reports; board or management oversight records.
Where the requirement sits: CC1.1 (integrity/ethics - code of conduct acknowledgment); CC1.4 (competence); CC2.2, CC2.3 (internal/external communication of policies); CC5.3 (policies and procedures)
Type 1 reports on whether controls are suitably designed and implemented at a single date. Type 2 reports on whether they also operated effectively throughout a period, with sample testing across that period. Buyers increasingly ask for Type 2, and many organizations skip Type 1 or use it only as a first milestone.
The policy and acknowledgment layer inside SOC 2 (CC1.1, CC2.2, CC5.3).
AllyMatter publishes this site.
Assessors
A licensed CPA firm (independent certified public accountants) performing the examination under the AICPA attestation standards and issuing the service auditor's report. Accredited by State board CPA licensure and the AICPA peer review program; no scheme-level accreditor and no public registry of SOC auditors.
No firm has claimed a SOC 2 assessor listing yet. Claim yours →
Consultants
A very large ecosystem: compliance automation platforms, readiness consultancies and the advisory arms of CPA firms. They scope trust services categories, write policies, map controls, collect evidence and run mock audits. Typical shape is a readiness phase, a Type 1 or a short first Type 2 period, then annual Type 2 reports.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Approve the policies SOC 2 asks for, keep every version, and record a named acknowledgment from each person who has to read them.