QULDEXResources · Glossary
SOC 2 definition: what the report is, in brief
What does SOC 2 mean?
A SOC 2 report lets a service provider show its customers, through an independent auditor, how it protects their data. Customers read the report in place of auditing the provider themselves.
The report describes the provider's system, lists the controls, and gives the auditor's opinion. A Type 2 report also sets out the tests performed and their results.
What are the types of SOC 2 report?
Whether controls are suitably designed as of a specific date.
Whether controls were suitably designed and operated effectively throughout a period.
Security is required; availability, processing integrity, confidentiality and privacy are added as relevant.
What is in a SOC 2 report?
The main sections of a Type 2 report.
| Section | What it contains |
|---|---|
| Auditor's opinion | The CPA firm's conclusion, and whether it is qualified |
| Management's assertion | The organisation's statement about its system and controls |
| System description | Services, infrastructure, software, people, procedures and data |
| Tests and results | Each control, the auditor's test and any exceptions |
This is an illustration written for this page, not a customer record.
SOC 2: key facts
| Topic | Detail | Notes |
|---|---|---|
| Owner | AICPA | The American Institute of Certified Public Accountants. |
| Criteria | 5 categories | Security, availability, processing integrity, confidentiality, privacy. |
| Common criteria | CC1 to CC9 | The security criteria that apply to every SOC 2 report. |
| Distribution | Restricted use | The report is intended for the organisation, its customers and others with enough knowledge to understand it. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What do people get wrong about SOC 2?
'SOC 2 certified'
No certificate is issued; it is an attestation report.
Instead: say you have a SOC 2 report, and which type.
Type 1 treated as Type 2
A Type 1 says nothing about controls working over time.
Instead: check the type and the period.
Not reading the exceptions
An unqualified opinion can still list exceptions.
Instead: read the tests and results section.
How does QULDEX handle this?
One control and one piece of evidence count towards every framework they apply to.
SOC 2: common questions
What does SOC stand for?
System and Organization Controls. The name covers a family of AICPA reports; SOC 2 is the one about security and related criteria.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 reports on the design of controls at a point in time. Type 2 reports on design and operating effectiveness over a period.
Who can issue a SOC 2 report?
Only a licensed CPA firm, following AICPA attestation standards.
Sources
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
- AICPA, SSAE No. 18, Attestation Standards: Clarification and Recodification (AT-C sections 105 and 205). aicpa-cima.com
- AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization. aicpa-cima.com
Run SOC 2 and ISO 27001 from one control set
Controls, evidence, findings and corrective actions in one audit workspace.