What Is SOC 2?

SOC 2 is an attestation report produced by an independent accounting firm on the design and, in one variant, the operating effectiveness of a service organisation's controls.

It is not a certification and there is no pass mark. The report is an auditor's opinion, and what matters commercially is the opinion and the exceptions listed, which is why sophisticated customers read the report rather than checking that one exists.

Type 1 and Type 2

A Type 1 report assesses whether controls are suitably designed at a point in time. It is faster to obtain and provides limited assurance, since a control can be well designed and never operated.

A Type 2 report assesses whether controls operated effectively throughout a period, typically three to twelve months. It is what most customers actually want, and the observation period is why the timeline is longer.

The trust services criteria

Security is mandatory. Availability, processing integrity, confidentiality and privacy are optional and chosen according to what the service does and what customers ask about.

Each additional criterion adds scope and cost. Most organisations start with security alone and add availability where uptime commitments are commercially significant.

You define the controls

Unlike a prescriptive standard, this framework states criteria and you describe the controls that meet them. The auditor assesses whether your controls address the criteria and whether they operated.

That flexibility is the main practical difference from ISO 27001, and it means two reports can describe very different control environments while both being clean.

What exceptions mean

A report noting exceptions is not a failure. Auditors record instances where a control did not operate as described, and a report with a small number of explained exceptions is normal.

What customers examine is whether exceptions touch controls relevant to them and what management said in response. A clean report with a narrow scope conveys less than a report with minor exceptions and comprehensive coverage.

Scope, and the bridge letter

Scope defines which systems and services the report covers. A report scoped to something other than the service being purchased provides limited assurance, and buyers increasingly read the scope statement first.

Reports also cover a past period, so a gap exists between the period end and the present. A bridge letter from management attests that nothing material changed, and is routinely requested.

Reading a report you receive

Most organisations consume these reports more often than they produce them, and most do not read them. The parts that matter are the scope, the auditor’s opinion, the exceptions and management’s responses, and the complementary user entity controls.

That last section lists what the report assumes you do — controls on your side that the provider’s controls depend on. It is routinely ignored, and it is the part that transfers obligations back to you.

Where to start

Establish which criteria your customers actually ask about, and whether a Type 1 would unblock the immediate commercial need while the observation period runs.

See Type 1 versus Type 2 and what to budget. GuardsArm delivers SOC 2 compliance.