SOC 2 is an attestation report issued by an independent CPA firm on the controls at a service organization, evaluated against the AICPA Trust Services Criteria. These guides explain each part in plain English.
Start here
SOC 2 Type 1 vs Type 2
Which report you need, and when. On SOC2Compliance.com.
How much SOC 2 costs
A full SOC 2 budget breakdown. On SOC2Compliance.com.
SOC 2 readiness checklist
The control-by-control checklist. On SOC2Compliance.com.
SOC 2 audit timeline
How long each phase usually takes.
Trust Services Criteria
The five categories and the common criteria.
What SOC 2 is, in one minute
- Who issues it: an independent, licensed CPA firm. No software platform can issue a SOC 2 report.
- What it covers: your controls, evaluated against the Trust Services Criteria. Security is always included; availability, processing integrity, confidentiality and privacy are added when relevant.
- Two types: Type 1 looks at the design of controls at a point in time; Type 2 also tests whether they operated effectively over a period.
- Who asks for it: mostly B2B customers checking that a vendor will protect their data.
This guide is general information, not audit or legal advice. Your CPA firm decides the scope, period and testing for your examination. soc2audit.ai is a product of Cybersecurity Services, LLC.