DataSecureSOC 2 is an examination of a service organization’s system and controls relevant to security and, where applicable, availability, processing integrity, confidentiality or privacy. An independent CPA firm performs the examination and issues a report. Customers use that report to understand controls relevant to the service they rely on.
Why do customers ask for SOC 2?
When a customer relies on your software or service, its security may depend partly on your people, processes and systems. A SOC 2 report gives authorized readers a structured view of a defined service and the auditor’s conclusion about the controls examined. The AICPA’s SOC 2 examination guide describes the report’s role in helping customers and business partners assess risks associated with a service organization.
A report does not guarantee that a product is secure, cover every service you offer, or replace a customer’s own vendor assessment. Confirm which product, legal entity, reporting period and report type the recipient needs.
The five trust services categories
The AICPA’s trust services criteria address five categories. Security is the common foundation of a SOC 2 examination; the other categories depend on the organization’s commitments, service and scope.
| Category | What it addresses | Illustrative question |
|---|---|---|
| Security | Protection against unauthorized access and related system risks. | How is privileged production access approved and reviewed? |
| Availability | Availability of the system for operation and use as committed or agreed. | How do you monitor the service and test recovery? |
| Processing integrity | Whether processing is complete, valid, accurate, timely and authorized. | How do you detect and resolve failed transactions? |
| Confidentiality | Protection of information designated confidential. | How do you identify and restrict access to confidential data? |
| Privacy | Personal information handling in relation to the organization’s privacy commitments and applicable criteria. | How do you handle requests concerning personal information? |
These are examples, not a prescribed set of controls. Discuss applicable categories, commitments and boundaries with your independent auditor.
SOC 2 Type I vs. Type II
A Type I report addresses the system description and the suitability of control design as of a specified date. A Type II report also addresses whether controls operated effectively over a specified period. A buyer may have a preference for a particular period and report type, so agree expectations before planning. Our Type I versus Type II guide compares them in detail.
What this looks like for a SaaS company
Imagine a SaaS company with a customer-facing application, a cloud provider and a distributed engineering team. Its customer asks for a Type II report covering the application. Management identifies the systems and people involved, documents responsibilities and decides the relevant categories with the CPA firm.
A control might require a designated owner to review production access periodically and follow up on unnecessary privileges. The team keeps the review, decisions and resulting changes for the agreed period. The auditor decides what to test and evaluates the evidence. A screenshot of today’s settings alone may not show whether a recurring review actually happened throughout the period. The evidence checklist has further examples.
How do you prepare for SOC 2?
- Clarify the request. Identify your customer’s desired service, report type, period and deadline.
- Define the system. Map the people, technology, providers, data and processes used to deliver that service.
- Assess and fix gaps. Compare current practices with your commitments and applicable criteria, assign owners and track remediation.
- Operate controls and retain evidence. Document what happened, who performed it, when, and how exceptions were handled.
- Coordinate the examination. Agree scope and timing with the independent CPA firm and respond to its evidence requests.
- Maintain the program. Address findings and continue operating controls beyond report delivery.
Use the readiness checklist to plan the work and the timeline guide to work backwards from a deadline.
Common questions
Is SOC 2 a certification?
People often say “SOC 2 certification,” but the result is an independent examination report, not a certificate. The report’s contents and opinion matter more than a badge.
Is SOC 2 legally mandatory?
SOC 2 is generally driven by customer, contract and business requirements rather than being a universal legal requirement. Specific contracts, laws and industry rules may impose other obligations; get advice for your circumstances.
Can our cloud provider’s report cover us?
Your provider’s report may inform your assessment of its services, but it does not automatically cover the controls your organization operates. Review shared responsibilities and the treatment of subservice organizations with your auditor.
How much does it cost?
Cost depends on scope, report type, existing controls, the auditor and preparation work. Our cost guide explains what to include when comparing proposals.
Who does what?
Your organization owns and operates its controls. DataSecure365 can assist with readiness and evidence coordination. The independent CPA firm performs the examination and determines its report and opinion.
Educational guidance, not legal advice or an audit opinion. Discuss your scope and reporting requirements with your auditor and qualified advisers.
Turn your first SOC 2 request into a plan.
Discuss your service, controls and readiness with DataSecure365.
Book a demo ↗