Cybersecurity glossary
What is SOC 2?
Also known as: SOC 2 Type II, SOC 2 Type I
Definition
SOC 2 is an attestation report from an independent CPA firm on a service organization’s controls relevant to security, availability, processing integrity, confidentiality and privacy.
Why it matters
Type I evaluates control design at a point in time; Type II also tests operating effectiveness over a period. Customers often request SOC 2 Type II reports during vendor reviews.
Common questions about SOC 2
- How do I check a software vendor’s security before signing a contract?
- What is SOC 2 and who needs it?
- When should a small business bring in a cybersecurity consultant?
- What is GRC in cybersecurity?
- What is the difference between ISO 27001 and SOC 2?
- How do I answer a customer security questionnaire?
- What does a GRC analyst do?
- What is the difference between AI security and cloud security?
Related Guides
GuideGRC
10 Ways to Protect PII in Your Organization
Learn how to protect PII across systems using practical safeguards, impact assessments, access controls, and retention rules for privacy teams.
Read more GuideGRC
10-Point GDPR Compliance Checklist for Security and Privacy Teams
A practical GDPR checklist covering data mapping, lawful basis, records of processing, PII protection, DPIAs, processor contracts, data subject rights, international transfers and 72-hour breach notification.
Read more GuideGRC
How to Do a DPIA: A Step-by-Step Security and Privacy Guide
Learn how to do a DPIA step by step. Identify privacy risks, assess necessity and proportionality, and implement controls to protect personal data.
Read more GuideSmall Business Security
Business Email Compromise: How It Works and How to Stop It
Learn how business email compromise attacks target finance teams and discover concrete controls, verification rules, and policies to protect your company.
Read more