SOC 2

SOC 2 is an attestation framework published by the AICPA. An organisation defines its own controls against the Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy — and an independent CPA firm examines those controls. A Type I report covers the design of the controls at a single date; a Type II report covers how they operated across a period, usually three to twelve months.

The security category, often called the Common Criteria, is the part every SOC 2 report includes. It asks for documented control over who can reach systems and data, how changes are approved before deployment, how incidents are detected and handled, and how risks are assessed. None of this is checked once: the observation period runs for months, so the evidence has to exist for the whole period.

That timing shapes the work. Access reviews, change tickets, monitoring alerts, and vendor assessments are gathered as the work happens, because an auditor samples from the full period and a gap in the record reads as a gap in the control. Reports are shared under NDA, and readers weigh the listed exceptions as carefully as the passes.