AICPA Trust Services Criteria, 2017
SOC 2
A report, not a certificate. An independent auditor examines your controls against the Trust Services Criteria and writes an opinion. A Type II covers a period, which is why continuous evidence matters: the readings you collect every day are the examination.
Do you need it?
Nobody is required to have one. Customers ask, and they ask in a particular order.
Yes
Your customers ask for the report.
Enterprise security reviews ask for a SOC 2 Type II the way they ask for ISO 27001, and some accept only this. If the question has come up twice, it will come up again.
Yes
You already run ISO 27001.
The controls overlap almost entirely. The additional work is the observation period and the auditor; the evidence is what you already collect.
Later
Nobody has asked yet.
Run the controls now, so the observation period can start the day a customer asks instead of a year later.
What the report covers
Security
The common criteria, always in scope
Access, change management, risk assessment, monitoring, incident response and vendor management. Every SOC 2 report includes this category; the other four are chosen.
Availability and confidentiality
The two most customers add
That the service is available as committed, and that confidential data is protected through its life. Backups, capacity, encryption and retention are the evidence.
Processing integrity and privacy
The two chosen when they apply
That processing is complete and accurate, and that personal information is handled as notified. Relevant for payment, data and consumer products.
Type I and Type II
A point in time, or a period
A Type I describes controls at a date. A Type II tests that they operated over a period, usually six to twelve months, and is the one customers mean.
The cycle
A period, an auditor, a report, every year. SOC 2 at the AICPA.
- Before the periodChoose the categories, write the system description, and make sure every control has evidence flowing. A readiness review catches gaps before the clock starts.
- The observation periodSix to twelve months during which the controls must operate and leave records. Nothing is collected afterwards; what was not recorded did not happen.
- The examinationA licensed CPA firm samples the period, tests the controls and issues the report with its opinion and any exceptions.
- Every yearThe next period starts where the last one ended, so the evidence never stops.
How the evidence lands
A year of readings
Access, two-factor, change, backups and monitoring, read on a schedule for the whole observation period and kept in the event log with their timestamps. The sample the auditor draws is already there.
Access reviews on record
Members, roles and leavers from your identity tools, so the quarterly review is a reading rather than a spreadsheet, and the exception list is short.
Vendor management
The vendor graph with each provider's sub-processors and reports covers the vendor criteria without a second system.
One evidence log, two reports
The same readings serve ISO 27001 and SOC 2. Controls map across frameworks in the catalog, so adding the report adds an auditor, not a programme.
See a Type II period fill itself from your own tools
Thirty minutes. We connect one of your integrations live and show the first readings landing on your controls.