SOC 2 (SOC 2)
An AICPA attestation report on a service organisation’s controls relevant to security, availability, processing integrity, confidentiality and privacy.
Overview
A Type I report assesses control design at a point in time; a Type II report assesses operating effectiveness over a period, typically three to twelve months.
As an industry standard it binds through regulation that cites it, contracts that require it or audits that test it. The authorities most closely connected to it are AICPA. It is often read together with SOC and ISO 27001.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
SOC 2 Type II is the most common security assurance enterprise buyers request.
Who it affects
SaaS and service providers and their customers.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to SOC 2. Select one to open it.
What to do about it
- 1Decide whether it applies through regulation, contract, audit or certification.
- 2Run a gap assessment against your current controls.
- 3Crosswalk it to the regulations and contracts that reference it.
- 4Collect evidence continuously for the audit period.
From requirement to evidence.
SOC 2 controls run continuously in Regulation Layer, so auditors receive sealed evidence for the full period.
Request early access →