SOC 2

An attestation report in which an independent auditor assesses a service organisation's controls against the AICPA's Trust Services Criteria.

A SOC 2 report is issued by a CPA firm. It covers security and, optionally, availability, processing integrity, confidentiality and privacy. A Type I report assesses the design of controls at a point in time; a Type II report assesses whether they operated effectively over a period, commonly three to twelve months.

Buyers usually ask for a Type II report. Because it names systems and controls in detail, companies share it under NDA or through an access request rather than publishing it.

What a reviewer wants to see

• The report itself, or its current status if an audit is under way
• A bridge letter if the report period ended some months ago
• The report's scope, so they know which systems it covers