SOC 2 guide
SOC 2 scope: system boundaries, trust services categories, subservice organisations and carve-outs
How to set the scope of a SOC 2 examination: the system and its boundary, the trust services categories your commitments call for, carve-out or inclusive treatment of subservice organisations, and how each choice shapes the examination effort and the finished report.
Key points
- A SOC 2 scope has four parts: the system behind the service, the trust services categories, the report date or period, and how vendors and clients at the boundary are treated.
- Security is examined in every report; the other four categories belong in scope only when your contracts, service levels or privacy notice already promise what they test.
- Your cloud platform is usually carved out: its controls stay outside the examination, while your oversight of it and your own configuration stay in.
- Every added system, location, category or inclusive vendor gives the service auditor more to test.
What a SOC 2 scope covers, and who decides it
A SOC 2 report carries no certificate with a scope line. Management defines the scope, the system description sets it out and the service auditor, the licensed CPA firm performing the examination, restates it in the opinion. Four decisions make it up: the system, meaning the service clients rely on and everything that delivers it; the categories of the AICPA's Trust Services Criteria to be examined; the report type, a date or a period, which our Type 1 vs Type 2 guide covers; and the treatment of vendors and clients at the boundary.
Settle all four with the service auditor at planning, since changing them after testing starts means re-planning the examination.
The system: five components inside a boundary you draw
The AICPA's description criteria, used both to prepare management's description and to evaluate it, describe a system through five components, and scoping traces the service through each.
- Infrastructure. Cloud accounts, networks, production hosts and databases, and any office or data centre running the service.
- Software. The application and every tool that can change or reach it: source control, the deployment pipeline, the identity provider, monitoring, ticketing and backup.
- People. Engineering, operations, support, security and management, contractors and offshore teams included, wherever they reach production or client data.
- Procedures. The automated and manual activities that deliver the service and operate the controls.
- Data. Client data received, stored, processed and returned, and the records showing the controls ran.
One test sets the boundary: could the component affect whether you meet your commitments to clients? If so, it is inside, unless a subservice organisation you identify operates it. Corporate systems with no path to the service can stay out; the laptops engineers use to reach production cannot. Our system description guide shows how to write the boundary down.
Choosing the categories from promises already made
Security, the common criteria CC1 to CC9, is examined in every SOC 2 report; adding any of the other four is management's choice. The evidence is already on file: master services agreements, service level schedules, data processing agreements, questionnaire answers, your trust page and your privacy notice. Match each commitment to the category that would test it.
| Category | In scope when | What it adds to the examination |
|---|---|---|
| Security | Always | Governance, risk, monitoring, access, operations, change and vendor oversight |
| Availability | A service level sets uptime, or you promise a recovery time | Capacity monitoring, backups and tested recovery |
| Processing Integrity | Clients act on your output as delivered: payroll runs, payment files, claims decisions | Input, processing and output controls and reconciliations |
| Confidentiality | A contract marks client information confidential and sets its protection and disposal | Classification, retention and secure disposal records |
| Privacy | Your own notice tells individuals how their personal information is handled | Notice, consent, access requests and complaints, judged against that notice |
A category missing from scope leaves the client who asked for it without an answer; one added before its controls exist is examined anyway, exceptions and all. Our Trust Services Criteria guide covers what each category asks.
Subservice organisations and user entity controls
A subservice organisation is a vendor whose controls, together with yours, are needed to meet your commitments: the cloud platform hosting production, a managed detection provider, a group company running your help desk. A supplier operating no such control is an ordinary vendor. Each subservice organisation is handled by one of two methods.
- Carve-out. Its controls stay outside your examination. Your description identifies the vendor, its service and the controls you expect it to operate, and the service auditor tests how you monitor it, typically through your yearly review of the SOC report the vendor publishes.
- Inclusive. Your examination takes in the vendor's relevant controls: your description includes them, the service auditor tests them and the vendor's management signs its own written assertion. It needs the vendor's cooperation and suits a sister company or a provider without a report, but enlarges the examination.
Complementary user entity controls mark the client side: controls your design assumes clients operate, such as removing their own leavers' access and keeping the API keys you issue secret. Keep the list short and genuine, because clients read each line as an obligation. Our guides to reading a SOC 2 report and vendor management go further.
Several services, several locations, and the effort each adds
Services sharing infrastructure, people and procedures can sit in one report, since one set of controls serves them all; platforms built by different teams on different stacks usually need a report each. Another route is to scope the service clients ask about first and add the rest later.
A location is in scope when people there operate controls or handle in-scope data, such as a delivery centre working client tickets. A sales office without system access is not, and remote staff bring their laptops into scope, not their homes.
There is no table of examination days: the service auditor plans its testing by professional judgement, and each scope decision feeds that plan. Our SOC 2 cost guide shows how the same drivers shape fees.
| Scope decision | What the service auditor must do | How to keep it proportionate |
|---|---|---|
| Another service or system | More walkthroughs and larger populations to sample | Share controls across services where the design allows |
| Another location | Test controls where they operate, on site or remotely | Run joiners, leavers and access reviews centrally |
| Another category | Test its additional criteria beside Security | Add it only when a commitment calls for it |
| An inclusive vendor | Test that vendor's controls inside your examination | Carve out vendors that publish their own report |
Three scoping mistakes that show up in the report
- Drawing the boundary around the weak system. A legacy platform or outsourced support desk is left out because its controls are weak, though it still delivers part of the service. The service auditor tests the description against the running system, and clients compare the boundary with what they use. Fix the system before the period; never write it out.
- Adding categories for the sales deck. Availability or Privacy goes in because a competitor's report lists it, with no recovery test or privacy notice behind it. The criteria are tested regardless, and the exceptions land in the document meant to impress. Add one only when a commitment needs it.
- Assuming the cloud provider covers everything. Its report covers its data centres and platform, not the accounts, identities, encryption settings and logging you configure on top. Carve it out, read its report every year and run the customer controls it lists as your own.
How the scope appears in the finished report
The service auditor's opinion names the system, the date or period and the categories, and notes any carved-out subservice organisation and that controls expected of it and of user entities were not examined. The description sets out the services, commitments, components and boundaries, each subservice organisation with its method, the complementary user entity controls and any criterion that does not apply, with the reason. A Type 2 adds the tests and results for each criterion in scope.
How Sterling sets your SOC 2 scope
A scope drawn from your commitments and agreed before the period opens.
Scoping is the first step of every Sterling SOC 2 engagement, ahead of the gap analysis. Sterling's expert and experienced consultants read your contracts, questionnaires and privacy notice, trace the service through its five components and settle each subservice organisation's method before management agrees the scope with its service auditor. Evidence runs in Effivity, included with the engagement, at no additional cost, and under Sustain™ the scope is reviewed before each new period. We ensure a successful SOC 2 examination for our clients. Sterling does not issue the report; the opinion comes only from the independent, licensed CPA firm you appoint.
Book a free discovery callSOC 2 scope: questions buyers ask
Who decides the scope: management or the service auditor?
Management defines the system, chooses the categories and signs an assertion about the description. The service auditor must be satisfied that the subject matter and criteria are appropriate before accepting the engagement, and will challenge a misleading boundary; the two normally settle it at planning.
Can we leave part of our platform out of the report?
Yes, if it is a genuinely separate service with its own boundary and the description says clearly what is covered. A component that helps deliver the reported service cannot be excluded.
Our cloud provider has a SOC 2 report. Does it cover our hosting?
It covers the provider's controls over its platform, not what you configure in your accounts. Carve the provider out and review its report yearly; the service auditor tests that review with your own cloud controls.
We process personal data. Must Privacy be in scope?
Not automatically. Privacy is built around commitments made to individuals in a notice. Where you handle personal data only on clients' instructions, the commitments usually sit in the data processing agreement, and Security with Confidentiality often covers them; confirm with your service auditor. The report does not replace data protection obligations.
Can we add a category or another service after the first report?
Yes. Each examination has its own scope, so a category or service can join when the next period is planned, provided its controls are running by the time that period opens. Tell clients which report will include it.
More SOC 2 guides
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 bridge letters, report validity and the annual cycle
- SOC 2 cost: what moves the price
- SOC 2 policies and evidence: what you need and what you do not
- SOC 2 readiness review checklist
- How to read a SOC 2 report
- SOC 2 for SaaS and technology
- SOC 2 in Singapore and South East Asia
- SOC 2 for start-ups and small teams
- The SOC 2 system description: what to write and what to leave out
- SOC 2 Trust Services Criteria explained, criterion by criterion
- SOC 2 Type 1 vs Type 2: which report, and when
- SOC 2 vs ISO/IEC 27001: which one, or both?
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice