SOC 2
SOC 2 is an attestation framework from the AICPA under which an independent CPA firm reports on whether a service organization’s controls meet the Trust Services Criteria — Security plus optional Availability, Processing Integrity, Confidentiality, and Privacy categories.
Type I vs Type II
A Type I report evaluates whether your controls are suitably designed at a single point in time. A Type II report evaluates whether they actually operated effectively over a period — typically 6 to 12 months. Customers generally want Type II; Type I is mainly a stepping stone that proves the design is right before you start the observation window.
Unlike ISO 27001 certification, SOC 2 is an attestation, not a certificate: a licensed CPA firm issues an opinion inside a detailed report you share with customers under NDA. There is no public register — the report itself is the deliverable.
SOC 2 or ISO 27001?
SOC 2 dominates North American SaaS procurement; ISO 27001 is the default internationally. The control content overlaps heavily — most organizations implement one set of controls and map it to both frameworks rather than running two programs.
Frequently Asked Questions
Is SOC 2 a certification?
No — it is an attestation. A CPA firm issues an opinion on your controls inside a report. There is no certificate and no public registry; you distribute the report to customers yourself, usually under NDA.
How long does a SOC 2 Type II take?
The observation period alone is typically 6–12 months, plus readiness work beforehand. Most organizations first complete a Type I (point-in-time) report to prove control design, then start the Type II clock.
Related Standards
- •AICPA Trust Services Criteria (2017, revised 2022)
- •AT-C 205 — attestation standard for SOC 2 engagements
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.