←  All terms
S
Security & Compliance

SOC 2

SOC 2 is an assurance framework for a service organization's controls in areas such as security and availability.

SOC 2 evaluates whether a service organization has appropriate controls in place for areas such as security, availability, confidentiality, and processing integrity. The assessment is performed by an independent auditor and documents how relevant controls are designed and, depending on the report type, how effectively they operate over time. Organizations often use SOC 2 reports to demonstrate their security and operational practices to customers and partners. The concept is closely related to ISO 27001 and Governance.

Read more

ISO 27001

Governance

Audit Log

Service Level Agreement

FAQ

SOC 2

When do buyers ask vendors for a SOC 2 report?
Mostly when procuring software and hosting services that process customer data or run business-critical operations. The report shortens security questionnaires because it documents independently tested controls. Depending on region and industry, ISO 27001 is requested instead or in addition. That is binding only if a contract or internal policy demands it.
What should be checked when reviewing a SOC 2 report?
Report type, audit period, systems in scope, criteria covered, and any exceptions noted by the auditor all matter. An outdated report, or a scope that leaves out the services actually used, says little. The report does not replace an internal risk assessment and does not establish legal compliance.
Which criteria does a SOC 2 report cover?
The basis is the Trust Services Criteria. Security is always included, while availability, confidentiality, processing integrity, and privacy can be added optionally. The service provider chooses the scope, and the report states it. Reviewers should check whether the criteria relevant to their own use case are actually covered.
Is SOC 2 a certification like ISO 27001?
No. SOC 2 is an attestation report, not a certificate that is passed or failed. An independent auditor describes the controls and issues an opinion on them. ISO 27001, by contrast, certifies an information security management system against a standard. The two set different emphases and do not replace each other.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 assesses whether controls are suitably designed at a single point in time. Type 2 also tests over a period whether those controls operated effectively. That makes Type 2 more informative about ongoing practice. When evaluating a vendor, the report type should always be checked first.