Executive Summary: What is it?
SOC 2 (System and Organization Controls) Type 2 is a reporting framework developed by the AICPA. It evaluates an organization's controls over a stated period based on the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
CFO / Business Impact: What does it cost/risk?
- Buyer Due Diligence: A customer reviewing a service provider reads its SOC 2 report: the system, the period, the categories in scope and the opinion, checked against its own use of the service.
- What It Leaves to You: The provider's management sets the scope, so a report may cover only some of the categories, carve out the providers it relies on (subservice organizations), and list controls the customer must run itself (complementary user entity controls). A clean report covers only what it names.
Technical Reality: How does it work?
- Examination, Not Monitoring: A SOC 2 report is issued by an independent CPA firm after examining a service organization's controls; a Type 2 report includes the CPA's tests of those controls and their results.
- Operating Over a Period: A Type 2 opinion states whether the controls operated effectively throughout the period, so the provider keeps evidence of their operation across all of it, and the report notes any exceptions the CPA's tests found.
What the Label Means in a Solution Profile
SOC 2 is a report an independent CPA firm issues on a service organization's security controls; software cannot hold one.
- Self-Hosted line: No self-hosted line carries SOC 2. When you run the software yourself, your organization is the one examined.
- Managed service line: "SOC 2 Type 2 (Audited)" means the vendor's service has such a report covering a stated period, and "SOC 2 Type 1 (Audited)" means a report as of one date. With Inherited, the label names a host after the dot, and the report belongs to that host, not to the vendor itself.