SOC 2

What it is

SOC 2 is an independent audit report on a service organisation's controls, measured against the AICPA Trust Services Criteria. It exists so that customers can rely on one auditor's report instead of each auditing their supplier separately.

Who it applies to

• Service providers, especially SaaS and cloud companies, that hold or process customer data
• Suppliers to North American customers, where SOC 2 reports are a common procurement requirement
• Customers and third party risk teams that review supplier SOC 2 reports
• European organisations selling into the US market, often alongside ISO 27001

Key points

• A Type 2 report carries much more weight than a Type 1, because it tests operation over time
• The organisation chooses its own controls and scope, so read the system description to see what is covered
• Exceptions in the test results are normal; what matters is whether they affect your use of the service
• Complementary user entity controls list what you as customer must do for the controls to work
• Subservice organisations, such as the cloud platform underneath, may be carved out and need their own reports
• Reports are confidential and usually shared under NDA, with bridge letters covering gaps between periods

Where to start

1. 1As a provider, run a readiness assessment against the Trust Services Criteria and pick the categories customers need
2. 2Implement and evidence controls, then start with a Type 1 or go straight to a Type 2 observation period
3. 3As a customer, read the opinion, scope, exceptions and complementary user entity controls, not just the cover page
4. 4Map SOC 2 controls to ISO 27001 if you need both, since much of the evidence overlaps