What Is SOC 2 Compliance? A Plain-English Guide

If you sell software to other businesses, a SOC 2 request usually arrives in a security questionnaire or a procurement checklist, often late in a deal. The prospect wants evidence that your company protects the data it handles, and a SOC 2 report is the form of evidence many buyers in the US expect.

This guide explains what SOC 2 is, who defines it, what the audit covers, how the report is structured, and what a first-time company should expect. It is written for founders, CTOs and security leads at SaaS companies who need to understand the framework before choosing an auditor, a compliance platform or a timeline.

What SOC 2 is

SOC 2 is an attestation report issued by an independent CPA firm on the controls a service organization uses to protect the systems and data it relies on to serve customers. It is part of the System and Organization Controls (SOC) suite from the American Institute of Certified Public Accountants (AICPA), which the AICPA describes as a suite of service offerings CPAs may provide in connection with system-level controls of a service organization.

The examination is performed under AICPA attestation standards. The auditor evaluates your controls against the Trust Services Criteria, and evaluates your written description of your system against the AICPA's description criteria (DC 200, the 2018 Description Criteria with revised implementation guidance issued in 2022).

SOC 2 is not a certification and there is no pass or fail grade. The output is a report containing the auditor's opinion, and each customer reads that report and decides whether your controls meet their own requirements. The framework is also not prescriptive: it sets out criteria, and your company designs the specific controls that meet them.

The Trust Services Criteria

The criteria for a SOC 2 examination come from the AICPA's 2017 Trust Services Criteria, published with revised points of focus in 2022. The criteria are organized into five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy.

Security is required in every SOC 2 examination. Its criteria are called the common criteria because they also apply to the other categories. The other four are optional, and you include them when they are relevant to your service and your customers' expectations. A SaaS company with uptime commitments might add Availability; one that handles customer secrets under contract might add Confidentiality.

The common criteria are grouped into nine series. CC1 through CC5 follow the structure of the COSO internal control framework: CC1 control environment, CC2 communication and information, CC3 risk assessment, CC4 monitoring activities and CC5 control activities. CC6 covers logical and physical access controls, CC7 system operations, CC8 change management and CC9 risk mitigation, which includes vendor and business partner risk.

Points of focus are characteristics that illustrate how a criterion might be met. They are guidance, not a checklist. The 2022 revision updated them to address topics such as privacy, vulnerability management and vendor risk, while the criteria themselves stayed the same.

SOC 1 vs SOC 2 vs SOC 3

The three reports in the SOC suite answer different questions. A SOC 1 report covers controls at a service organization that are relevant to its customers' internal control over financial reporting. It is common for payroll processors, claims processors and similar services whose output feeds a customer's financial statements.

A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality and privacy. It includes a detailed system description and, for a Type 2, the auditor's tests and results. Because of that detail, it is a restricted-use report shared with customers and prospects, usually under a nondisclosure agreement.

A SOC 3 report addresses the same Trust Services Criteria as SOC 2 but, as the AICPA notes, does not provide the same level of detail. It is a general use report that can be distributed freely, so some companies publish it on their website. Most enterprise security reviewers will still ask for the SOC 2 report itself.

Type 1 vs Type 2

A SOC 2 Type 1 report covers the fairness of your system description and the suitability of the design of your controls as of a specific date. It answers the question of whether the right controls are in place on that day.

A Type 2 report covers the same items plus the operating effectiveness of those controls over a period of time. The auditor samples evidence across the period, such as access reviews, change tickets and onboarding records, to test whether controls worked as described. Audit firm PBMares notes that Type 2 periods commonly run 12 months, while first reports may cover 3, 6 or 9 months.

Many first-time companies start with a Type 1 to answer a pending customer request, then move to a Type 2. Others go straight to a short-period Type 2. The right choice depends on what your customers will accept and how long your controls have already been operating. Enterprise buyers generally treat a Type 2 as the stronger evidence.

Who can perform a SOC 2 audit

Only a licensed CPA firm can issue a SOC 2 report, and the firm must be independent of the company it examines and follow AICPA professional standards. Compliance software vendors, consultants and readiness assessors can help you prepare, but they cannot issue the opinion unless they are, or engage, a licensed CPA firm. With Scytale, for instance, the audit is performed by an independent CPA firm, and a partner audit can be purchased as a separate line item.

A typical engagement has three stages. First is scoping, where you and the auditor agree on the system, the categories and the report type. Many companies run a readiness assessment at this stage to find gaps. Second is the examination itself: for a Type 2, the observation period followed by fieldwork, in which the auditor requests evidence, interviews staff and tests samples. Third is reporting, when the auditor drafts the report, you review the system description and management's assertion, and the final report is issued.

When choosing a firm, ask about its experience with companies of your size and stack, how it collects evidence, whether it accepts evidence exported from compliance platforms, and its expected timelines. The directory lets you compare compliance platforms and see which auditor relationships each one lists.

What a SOC 2 report contains

A SOC 2 report has a standard structure, and knowing it helps you prepare yours and read your vendors' reports. The first section is the independent service auditor's report, which contains the opinion on whether the system description is fairly presented, whether controls are suitably designed and, for a Type 2, whether they operated effectively. An unmodified opinion means the auditor found no material issues; a qualified opinion calls for closer reading.

Next is management's assertion, a signed statement from your company that the description is accurate and the controls meet the criteria. Then comes the system description, written by your team against DC 200. It describes your services, service commitments and system requirements, and the components of the system: infrastructure, software, people, procedures and data. It also lists complementary user entity controls, which customers must operate themselves, and subservice organizations such as cloud providers, typically presented using the carve-out method.

The following section lists each control mapped to the criteria, the auditor's test procedures and the results. Exceptions, where a control did not operate as described in a sampled instance, appear here. An optional final section can hold unaudited information, such as management's responses to exceptions.

Why SaaS companies get asked for SOC 2

The most common trigger is an enterprise security review. When a larger customer evaluates a vendor, its security or procurement team sends a questionnaire and asks for independent evidence. A SOC 2 report can answer many questions at once and shortens reviews for both sides. Other triggers include a customer contract clause, a partner or marketplace requirement, investor due diligence, and cyber insurance applications.

Customers usually expect a current report, and PBMares notes that although reports do not technically expire, they are generally considered valid for 12 months from issuance. This is why most companies move to an annual Type 2 cycle.

Between reports, customers may ask for a bridge letter, also called a gap letter. Audit firm Linford & Company explains that a bridge letter is issued on the service organization's letterhead and signed by its management, not the auditor, and states whether there have been material changes to controls since the report period ended. It provides no assurance, and Linford notes most cover no more than three months.

Preparing for your first SOC 2

Start by defining scope: which product, infrastructure, teams and data are in the system, and which categories you need. Talk to the customers asking for the report to learn whether a Type 1 will satisfy them and which categories they expect.

Next, run a gap assessment against the criteria. Typical early work includes written policies, a risk assessment, access reviews, security awareness training, background checks, vendor reviews, incident response procedures, change management with code review, logging and monitoring, and backup and recovery testing. Assign an owner to each control and decide how evidence will be collected.

Many teams use a compliance automation platform to connect to cloud, identity and HR systems, track controls and gather evidence, and to coordinate with the auditor. Platforms differ in integrations, frameworks supported, auditor networks and pricing models, so compare several against your stack and timeline. Platforms such as Scytale, for example, pair the software with a dedicated in-house GRC expert included in the subscription and use an AI agent, Scy, to help with evidence collection and security questionnaires, which can help teams without in-house compliance staff. The directory lists platforms side by side for this purpose.

Frequently asked questions