Home / Knowledge hub / SOC 2
Knowledge hub
SOC 2
An audit report on how well a service provider protects customer data.
What it means
SOC 2 is an audit report, not a certificate. An independent auditor (a licensed CPA firm) examines the controls a service provider uses to protect customer data and writes an opinion on them. The framework comes from the AICPA, the American accounting body, and the report is about your systems, policies and evidence.
The assessment uses the Trust Services Criteria. Security is always included, and a company can add availability, processing integrity, confidentiality and privacy. You choose which apply to your service, and the report states exactly which ones the auditor examined, so read that section first.
Why it matters
For software companies selling to larger buyers, a SOC 2 report often moves a deal along. It answers a long security questionnaire with one document. Without it, sales teams can spend weeks on repeated forms, and some buyers will not progress at all.
It also gives the company a reason to keep its habits: access reviews, change approval, incident handling, vendor checks. Those controls reduce real risk, but the report only says the controls existed and operated. It does not promise that the product has no vulnerabilities.
How it shows up
A report comes in two types. Type II covers a period of time, while Type I looks at design on a single date. Auditors ask for evidence for each control: screenshots, tickets, logs, policies. Many companies use compliance software to collect it, and still need people to do the underlying work.
Common gaps: access that nobody reviews, former staff accounts left active, vulnerability findings with no owner, and no record that a fix was checked. The criteria expect you to find and manage vulnerabilities, so keep penetration test reports and retest results ready for the auditor.
Questions people ask
SOC 2, answered
Is SOC 2 a certification?
No. It is an attestation report in which an independent CPA firm gives an opinion on your controls. There is no pass or fail badge, though the opinion can be qualified if something fell short.
Buyers read the report itself.
What is the difference between SOC 2 Type I and Type II?
Type I describes whether controls are suitably designed at one date. Type II tests whether they operated effectively over a period, commonly several months.
Most buyers want Type II, because it shows the controls working over time.
Does SOC 2 require penetration testing?
The criteria do not name penetration testing in so many words, but they expect you to identify and manage vulnerabilities. Auditors and customers commonly ask for an annual test report as evidence.
Check what your auditor expects.
Who sees a SOC 2 report?
Reports are usually restricted to the customer and prospects who ask, often under a confidentiality agreement. They are not published like a certificate.
A shorter public summary or trust page sometimes accompanies it.
How is SOC 2 different from ISO 27001?
SOC 2 is an auditor’s report on your controls against the Trust Services Criteria, common in North America. ISO 27001 is a certification of your management system, more common internationally.
Many companies hold both.
Sources
Where this comes from
Related
Terms that sit next to this one
SOC 2 Type II
A SOC 2 report showing controls worked over a period, not on one day.
ISO 27001
The international standard for running an information security management system.
Security questionnaire
The list of questions a buyer's security team sends before they sign.
Attestation letter
A short signed statement that a test was done, for customers or auditors.
Vulnerability management
The loop of finding, prioritising, fixing and checking the fix held.
What will the auditor ask to see?
Auditors look for evidence that vulnerabilities are found and fixed. Our findings show what was exploited, and a fix is proven by re-running the exact exploit, which gives you a record to hand over. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.