Glossary
SOC 2
SOC 2 is an AICPA framework in which an independent CPA firm examines a service organization's controls for security, and optionally availability, processing integrity, confidentiality and privacy, and issues a report customers use to assess vendor risk.
What Is SOC 2?
In short SOC 2 reports are built on the AICPA's Trust Services Criteria, which cover five categories: security, availability, processing integrity, confidentiality and privacy.
Security, also called the common criteria, is required in every SOC 2; a company adds the other four when they matter to its service. The examination follows the AICPA attestation standards (SSAE No. 18), so the result is an auditor's report and opinion, not a certificate.
There are two types. A Type 1 report covers whether controls are suitably designed at a point in time and does not look back over a period. A Type 2 report also tests whether the controls operated effectively over a period, such as 12 months, so it gives buyers more assurance.
SOC 2 Example
For example, a 40-person SaaS company loses two enterprise deals in one quarter at the security review stage. It spends three months on readiness, then completes a Type 2 examination covering six months of operation, and shares the report through its trust page. Its next security questionnaires take days instead of weeks because most answers point to the report.
SOC 2 in Practice
For B2B sales, a SOC 2 report shortens security reviews. Mid-market and enterprise buyers often ask for a current Type 2 report, and lacking one can stall procurement. Buyers of sales tools ask too, because those tools hold CRM data, email content and contact records. Companies share their report under NDA, often through a trust center page.
FAQ
What are the 5 Trust Services Criteria?
Security, availability, processing integrity, confidentiality and privacy. Security is required in every SOC 2 report; the other four are included when they are relevant to the service.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 looks at the design of controls at a point in time. Type 2 also tests that the controls operated effectively over a period, such as 12 months, so it gives buyers more assurance.
Who performs a SOC 2 audit?
An independent CPA firm. It examines the controls against the Trust Services Criteria and issues the report under the AICPA's attestation standards.
Is SOC 2 a certification?
No. SOC 2 is an attestation: an independent auditor's report and opinion on your controls. Vendors often say SOC 2 certified, but the accurate claim is that they have a SOC 2 Type 1 or Type 2 report.
The new Ken opens to the waiting list in batches.
Related
- GTM Glossary
Every GTM term, grouped by topic.
- BYOK (bring your own key)
- RFP (request for proposal)
- CRM
- Sales cycle
- Buying committee (buying group)
- Ken features
Sources
| Source | Checked |
|---|---|
| AICPA & CIMA: 2017 Trust Services Criteria (with revised points of focus, 2022) | |
| Microsoft Learn: SOC 2 Type 2 | |
| Linford & Co: SOC 2 security criteria |
Changelog
- Page published.