The short version
SOC 2 is an attestation framework created by the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm examines the controls a service organization uses to protect a system, then issues a report with its opinion. The controls are evaluated against the AICPA's Trust Services Criteria.
It is not a certification. Nobody "passes" SOC 2. You receive a report, and the report contains an opinion. A clean (unqualified) opinion is the goal, but buyers read the whole report, including any exceptions the auditor noted.
Why customers ask for it
When a company hands you its data, it inherits your risk. Its security team needs evidence that your controls exist and work. A SOC 2 report answers hundreds of questionnaire questions at once, with an independent auditor standing behind the answers. For many B2B SaaS deals, it is what lets procurement move forward.
What's in the report
A SOC 2 report typically has these sections:
- The auditor's opinion on whether your system description is fair and your controls are suitably designed (and, for Type II, operating effectively).
- Management's assertion, a signed statement from your company about the system and its controls.
- The system description, written by you, covering your services, infrastructure, software, people, data and processes.
- Criteria, controls and test results, where each control is mapped to a criterion, along with what the auditor tested and whether any exceptions occurred.
Reports are restricted-use: they go to customers and prospects under NDA. If you want something public for your website, a SOC 3 report is a short general-use version.
SOC 1, SOC 2, SOC 3
| Report | Focus | Audience |
|---|---|---|
| SOC 1 | Controls relevant to customers' financial reporting (for example, payroll or billing processors) | Customers' auditors |
| SOC 2 | Security, availability, processing integrity, confidentiality and privacy of a system | Customers under NDA |
| SOC 3 | Same criteria as SOC 2, summarized without test details | Anyone |
Type I and Type II
A Type I report covers control design at a single point in time. A Type II report covers design and operating effectiveness over a period, usually between three and twelve months. Most enterprise buyers ultimately want a Type II. The Type I vs. Type II guide covers how to choose.
What it takes from your team
The audit fee is only part of the cost. The bigger investment is time: writing policies, changing how access is granted and removed, setting up logging and alerting, running access reviews and risk assessments, and collecting evidence. For a small company starting from scratch, getting to a Type I typically takes a few months of part-time work across engineering and operations.
The most common delay isn't technical. Recurring controls like quarterly access reviews must actually happen on schedule, with evidence, throughout a Type II window.
Your cloud provider's report
Your AWS, Google Cloud or Azure environment runs on infrastructure you don't control. Most SOC 2 reports handle this with the carve-out method: your report excludes the provider's controls and points to the provider's own SOC 2. Your auditor will still expect you to review those reports and to cover the complementary controls they assign to customers, like configuring access and encryption correctly.
Where to start
Start by writing down which customer asked, which product they use, and when they need the report. That defines your scope. Then take the readiness checklist for a rough picture of your gaps.