SOC 2
An AICPA attestation — not a certification — in which an independent auditor reports on a service organization's controls against the Trust Services Criteria. The de facto vendor-security bar for B2B SaaS selling into the enterprise.
SOC 2 reports come in two flavors: a Type I report, which opines on whether controls were suitably designed at a single point in time, and a Type II report, which opines on whether those controls actually operated effectively over an observation period — typically three to twelve months. Type II is what most enterprise buyers actually ask for, because it demonstrates sustained operation, not a one-time snapshot.
The report is built on the AICPA's five Trust Services Categories: Security (the only mandatory one, sometimes called the "Common Criteria"), Availability, Processing Integrity, Confidentiality, and Privacy. An organization scopes in whichever categories are relevant to what it sells — a payments company will typically add Processing Integrity; a company handling sensitive personal data will often add Confidentiality and Privacy.
Who is impacted
Any organization that stores, processes, or transmits customer data on behalf of other businesses and needs to demonstrate that to enterprise buyers — SaaS vendors above all, but also data centers, managed service providers, and other B2B service organizations. It is a market requirement driven by customer due diligence, not a legal mandate.
Requirements
There is no fixed checklist — a licensed CPA firm designs the audit around the organization's own described system and the Trust Services Criteria it has scoped in, then tests whether the organization's actual controls meet those criteria. In practice this means real, evidenced controls across access management, change management, risk assessment, vendor management, incident response, and monitoring, sustained over the audit period for a Type II report.
Executive guides & research
SOC 2: The Complete Executive Guide
What SOC 2 actually is, how the audit process works, and how to avoid the most common mistakes that turn a straightforward attestation into a stalled deal cycle.
Templates & checklists
Glossary
SOC 2 Type II
A SOC 2 report opining on whether an organization's controls operated effectively over an observation period (typically 3-12 months), as opposed to a Type I report's single point-in-time design opinion.
Trust Services Criteria
The AICPA's five categories a SOC 2 report can be scoped against: Security (mandatory), Availability, Processing Integrity, Confidentiality, and Privacy.
Related regulations
Related
Stay ahead of SOC 2 changes
Get Regulatory Alerts the moment something about SOC 2 changes — new deadlines, guidance updates, enforcement actions.