What is SOC 2 and who needs it?
Short answer
SOC 2 is an attestation report, issued by an independent CPA firm under AICPA standards, on how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. SaaS and service companies usually pursue it because customers ask for it.
The details
A Type I report assesses whether controls are designed properly at a point in time. A Type II report also tests whether they operated effectively over a period, which customers usually prefer. Security is included in every SOC 2; the other criteria are chosen by scope.
Terms explained
- SOC 2
- SOC 2 is an attestation report from an independent CPA firm on a service organization’s controls relevant to security, availability, processing integrity, confidentiality and privacy.
Related questions
Related Guides
GuideGRC
10 Ways to Protect PII in Your Organization
Learn how to protect PII across systems using practical safeguards, impact assessments, access controls, and retention rules for privacy teams.
Read more GuideGRC
10-Point GDPR Compliance Checklist for Security and Privacy Teams
A practical GDPR checklist covering data mapping, lawful basis, records of processing, PII protection, DPIAs, processor contracts, data subject rights, international transfers and 72-hour breach notification.
Read more GuideGRC
8 Steps to Prepare for a Security Audit (ISO 27001, SOC 2 or Customer Audit)
How to prepare for an ISO 27001, SOC 2 or customer security audit: scope, control mapping, evidence collection, GRC platforms, mock audits, interviews and managing findings.
Read more GuideGRC
How to Do a DPIA: A Step-by-Step Security and Privacy Guide
Learn how to do a DPIA step by step. Identify privacy risks, assess necessity and proportionality, and implement controls to protect personal data.
Read more