SOC 2 Compliance Requirements

SOC 2 (System and Organization Controls 2) establishes a framework for evaluating how service organizations manage customer data across five Trust Services Criteria. Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 applies broadly to technology and cloud-based service providers that store, process, or transmit client information. The framework is voluntary but functions as a de facto market requirement in B2B SaaS, managed services, and cloud infrastructure sectors.

Definition and Scope

SOC 2 is an attestation standard published by the AICPA, formally governed under its Assurance Services Executive Committee. The framework measures a service organization's controls against five Trust Services Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy. Of these, Security is the only mandatory criterion; the remaining four are selected based on the services rendered and contractual obligations.

The standard applies to any third-party service organization whose systems handle client data. Unlike HIPAA cybersecurity requirements or PCI DSS compliance, SOC 2 does not emerge from federal statute or regulatory mandate — it is a market-driven attestation that enterprises use to evaluate vendor risk. The scope is defined by the auditor and management together in the System Description, which must conform to AICPA's description criteria (DC section 200).

How It Works

SOC 2 compliance is verified through an audit conducted by a licensed CPA firm. The AICPA restricts issuance of SOC 2 reports to licensed CPAs, distinguishing it from self-assessed frameworks. Two report types exist with distinct structural and temporal boundaries:

1. SOC 2 Type I — Evaluates whether controls are suitably designed at a single point in time. It does not assess whether those controls operated effectively over a period.
2. SOC 2 Type II — Evaluates both design suitability and operating effectiveness over a defined observation period, typically a minimum of six months, though 12-month periods are standard in enterprise procurement.

The audit process follows this sequence:

1. Scoping — Management defines which systems, services, and TSC apply to the engagement.
2. Readiness Assessment — Internal or third-party gap analysis against the selected TSC criteria, often mapped to AICPA's 2017 Trust Services Criteria document (TSP section 100).
3. Evidence Collection — Auditors gather control documentation, configuration records, access logs, and policy artifacts across the observation window.
4. Testing — CPA firm applies attribute sampling and inspection procedures against defined control objectives.
5. Report Issuance — The final SOC 2 report includes the auditor's opinion, management's assertion, the system description, and a detailed listing of controls and test results.

The AICPA's Trust Services Criteria align substantially with NIST SP 800-53 control families, allowing organizations already pursuing federal compliance to map existing controls into SOC 2 evidence packages.

Common Scenarios

SaaS Vendor Procurement — Enterprise buyers routinely require SOC 2 Type II reports before executing contracts. A vendor without a current report (typically issued within the prior 12 months) may be excluded from procurement cycles at large financial institutions or healthcare systems.

Cloud Infrastructure Providers — Managed service providers operating in multi-tenant environments obtain SOC 2 reports covering the Security and Availability criteria to address uptime and access control obligations. Subservice organizations (vendors to the vendor) are addressed either under the carve-out method, where their controls are excluded, or the inclusive method, where the primary auditor extends testing.

Regulated Industry Supply Chains — Healthcare-adjacent technology vendors subject to cybersecurity third-party risk compliance requirements may use SOC 2 Type II as partial evidence under HIPAA's business associate risk management obligations, although SOC 2 does not substitute for a HIPAA Business Associate Agreement.

Startups Seeking Enterprise Deals — Early-stage companies frequently initiate SOC 2 Type I engagements to establish baseline attestation, then mature to Type II within one to two audit cycles as operational history accumulates.

Decision Boundaries

Type I vs. Type II Selection — Type I is appropriate when an organization needs to demonstrate control design for an immediate procurement requirement and lacks the 6-to-12-month operational history required for Type II. Type II is required by most Fortune 500 procurement policies and provides substantially more assurance. Auditors cannot issue a Type II report covering a period shorter than six months without qualification.

SOC 2 vs. SOC 1 — SOC 1 (formerly SAS 70) addresses internal controls over financial reporting (ICFR) and is governed by AT-C section 320. SOC 1 applies to organizations whose services directly affect a customer's financial statement assertions — payroll processors, transfer agents, and claim processing systems. SOC 2 covers operational and data security controls and does not address ICFR. Selecting the wrong report type is a material error in vendor risk management programs.

SOC 2 vs. ISO 27001 — ISO 27001 compliance requires an accredited third-party certification body to certify a management system, resulting in a certificate rather than a report. SOC 2 produces an attestation report with detailed control testing results. ISO 27001 is more common in European and Asia-Pacific procurement contexts; SOC 2 dominates North American B2B technology markets. Organizations operating across both markets maintain both credentials.

Scope Creep Risk — Including excessive systems in the system description increases audit cost and introduces risk of control failures that could result in a qualified opinion. AICPA guidance recommends scoping to systems that are material to the service commitments disclosed in the system description.

References

• AICPA — Trust Services Criteria (2017)
• AICPA — SOC 2 Overview
• AICPA — AT-C Section 205 (Attestation Standards)
• NIST SP 800-53 Rev. 5 — Security and Privacy Controls
• AICPA — Description Criteria (DC Section 200)