What it covers. SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards on a service organisation's controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always included, while the others are optional. A Type 1 report assesses control design at a point in time, and a Type 2 report also tests operating effectiveness over a period.
In practice. Service organisations define the system in scope, design controls to meet the selected criteria and gather evidence continuously for the audit period. Customers review the report, including the auditor's opinion, exceptions, scope, carved out subservice organisations and complementary user entity controls they are expected to operate themselves. Evidence includes policies, access reviews, change records, monitoring and incident records.
Common gaps. Customers often read only the opinion and miss exceptions or scope limitations. Complementary user entity controls are frequently not implemented by the customer.