SOC 2
Definition
SOC 2 reports on audited controls of a service provider based on established trust criteria.
SOC 2 refers to AICPA audit reports on controls of a service organization relevant to the Trust Services Criteria. Type I assesses control design at a point in time; Type II additionally assesses operational effectiveness over a period.
Simply explained
An audit report describes specific protective measures of a provider and, depending on the type of report, also their effectiveness over a period of time.
Why it matters in practice
The term supports companies in selecting technologies sensibly, anchoring them organizationally, and using them competently.
Example from business
A SaaS provider has a SOC 2 Type II report created for a defined system scope regarding the design and effectiveness of relevant controls.
Limits and pitfalls
- Portraying SOC 2 as a product certification or complete security guarantee, ignoring report type, system scope, period, exceptions, and customers' complementary controls.
Origin & history
The AICPA developed SOC reports from earlier SAS 70 audits; SOC 2 uses the Trust Services Criteria.
Use in mid-sized companies
- Possible example: A SaaS provider has a SOC 2 Type II report created for a defined system scope regarding the design and effectiveness of relevant controls.
Frequently asked questions
What does SOC 2 mean?
SOC 2 refers to AICPA audit reports on controls of a service organization relevant to the Trust Services Criteria. Type I assesses control design at a point in time; Type II additionally assesses operational effectiveness over a period. What mistakes should be avoided? Portraying SOC 2 as a product certification or complete security guarantee, ignoring report type, system scope, period, exceptions, and customers' complementary controls.
Sources
- SOC 2 reports · AICPA, SOC 2 reports
Source checked on 10.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: