Two-minute brief
SOC 2 requirements explained: video brief
A two-minute brief on what a SOC 2 examination looks at: the Trust Services Criteria, the common criteria for Security and what the CPA firm's report contains.
Key takeaways
- SOC 2 sets criteria; you design the controls that meet them for your system.
- Security is always in scope; four further categories are optional.
- The common criteria CC1 to CC9 start from the COSO internal control framework.
- Type 1 covers design at a date; Type 2 covers operation over a period.
- The report is restricted-use and usually shared under a non-disclosure agreement.
Criteria, not a fixed list of controls
SOC 2 does not prescribe controls. It sets criteria, and each service organisation designs the controls that meet them for its own system. The criteria sit in five categories: Security, which is examined in every report, and availability, processing integrity, confidentiality and privacy, which add their own criteria when brought into scope. This short film lays out that structure.
The Security criteria, known as the common criteria, are organised in nine series, CC1 to CC9. The first five follow the COSO internal control framework, from the control environment and communication to risk assessment, monitoring and control activities; the last four cover the security controls clients care most about. In practice the control environment looks like management oversight of security, defined responsibilities, background checks and a code of conduct people sign, and communication looks like published policies, written service commitments and a route to report incidents and concerns.
What the report contains and how it is used
The examination is carried out by a licensed CPA firm under the AICPA attestation standards, or an equivalent practitioner under ISAE 3000 outside the United States. A Type 1 reports on the design of controls as at a date; a Type 2 reports on their operation over a period. The report contains the CPA firm's opinion, management's assertion and a description of the system, and a Type 2 adds the tests performed and their results.
The deliverable is a restricted-use report, shared with clients and prospects, usually under a non-disclosure agreement. SOC 1 is a different report on controls relevant to clients' financial reporting, and SOC 3 is a general-use summary of a SOC 2 examination that can be published. The criteria are the AICPA's 2017 Trust Services Criteria, with revised points of focus issued in 2022.
The practical question for any service organisation is whether its controls operate consistently enough, for long enough, to earn an opinion its clients will accept. The scope is yours to define, so it should describe the service and systems clients actually rely on.
SOC 2 at a glance
- Purpose
- Independent assurance that the controls behind your service meet the AICPA Trust Services Criteria for security and, where you choose, availability, processing integrity, confidentiality and privacy
- Relevant to
- Service organisations that hold or process client data: SaaS, cloud, BPO, fintech, managed services, payroll and professional services, at any size
- Edition
- The AICPA's 2017 Trust Services Criteria, with the revised points of focus issued in 2022; the criteria themselves are unchanged
- Attestation
- Examined and reported on by a licensed CPA firm under the AICPA attestation standards, or an equivalent practitioner under ISAE 3000 outside the US; Type 1 as at a date, Type 2 over a period
- Sterling's role
- Scope and gap analysis, control design with your team, Effivity, training, readiness assessment and support through fieldwork, then Sustain™ into the next period
- Cost and timing
- Total investment for a SOC 2 programme depends on the current maturity of your controls, the categories in scope, locations and number of employees. The process typically takes 3 to 6 months to a Type 1 report and 9 to 15 months to a first Type 2 report
SOC 2: questions people ask
Is SOC 2 a certification?
No. There is no SOC 2 certificate and no register of certified companies. The outcome is an attestation report in which a licensed CPA firm expresses an opinion on your controls against the Trust Services Criteria. Anyone offering a "SOC 2 certificate" is offering something the framework does not contain. If you want something to publish, a SOC 3 report is the general-use version of the same examination.
Type 1 or Type 2: which report should we get first?
A Type 1 reports on the design of your controls as at a date and can be issued once they are in place. A Type 2 reports on design and operating effectiveness over a period and is what most enterprise clients ask for. If a client is waiting, a Type 1 now with the Type 2 period already running is often the right sequence; if there is time, going straight to a Type 2 avoids paying for two examinations.
Which trust services categories should be in scope?
Security is always in scope. Add availability if clients rely on uptime commitments, confidentiality if you hold their confidential data under contract, processing integrity if processing accuracy matters to them, as in payments, payroll or claims, and privacy if you handle personal information on their behalf. Scope follows what your clients depend on, not what looks impressive.
Who can issue our SOC 2 report, and can Sterling issue it?
Only an independent, licensed CPA firm working under the AICPA attestation standards can issue a SOC 2 report; outside the United States, equivalent practitioners report under ISAE 3000. Sterling prepares your organisation, helps you shortlist a firm and supports you through fieldwork. Sterling does not issue the report and is not your auditor.
We are outside the United States. Does SOC 2 apply to us?
Yes. SOC 2 is requested by clients, not imposed by a regulator, so a BPO in the Philippines, a software company in India or a service provider in the UAE serving North American clients is asked for it as readily as a US company. A licensed CPA firm examines under the AICPA standards wherever you are based, or a practitioner reports under ISAE 3000.
Keep exploring
Related to this video
Read next
Services
The complete guide
Everything on SOC 2
Start with the SOC 2 page, or go straight to the guide you need.
On the SOC 2 page
Guides
- SOC 2 bridge letters, report validity and the annual cycle explained
- SOC 2 auditor questions
- SOC 2 in Australia
- SOC 2 benefits
- SOC 2 case study
- Choosing a SOC 2 service auditor
- SOC 2 common mistakes
- SOC 2 continuous monitoring
- SOC 2 cost
- Decision guide
- Effivity for SOC 2
- SOC 2 exceptions and qualified opinions
- SOC 2 gap analysis
- SOC 2 governance
- SOC 2 implementation plan
- SOC 2 in India
- SOC 2 in the Netherlands and Europe
- SOC 2 policies and evidence
- SOC 2 readiness review checklist
- How to read a SOC 2 report
- SOC 2 scope
- SOC 2 in Singapore and South East Asia
- SOC 2 for start-ups and small teams
- The SOC 2 system description
- The SOC 2 examination
- SOC 2 in the Philippines
- SOC 2 in the UK
- SOC 2 timeline
- SOC 2 training
- SOC 2 Trust Services Criteria explained
- SOC 2 Type 1 vs Type 2
- SOC 2 in the UAE and GCC
- SOC 2 vendor management and subservice organisations
By industry
More videos: Information security, cyber and cloud
- How to implement ISO/IEC 27017Implementation walkthrough · 3 min 14 s
- ISO/IEC 27017 requirements explainedTwo-minute brief · 2 min
- How to implement CMMC 2.0Implementation walkthrough · 3 min 15 s
- CMMC 2.0 requirements explainedTwo-minute brief · 2 min
- How to implement CSA STARImplementation walkthrough · 3 min 15 s
- CSA STAR requirements explainedTwo-minute brief · 2 min
- How to get Cyber Essentials certifiedImplementation walkthrough · 3 min 15 s
- Cyber Essentials requirements explainedTwo-minute brief · 2 min
- How to comply with the DESC Information Security Regulation (Dubai)Compliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your SOC 2 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice