Developed by the American Institute of CPAs (AICPA), SOC 2 defines criteria for managing customer data based on five “trust service principles”—security, availability, processing integrity, confidentiality and privacy.

A SOC 2 report essentially verifies whether an organization is in compliance with the requirements relevant to Security, Processing integrity, Availability, Confidentiality, and Privacy. It is an audit meant for service organizations that holds, stores, or processes private data of their clients. A SOC 2 audit report provides the organization and its clients an assurance that the reporting controls are suitably designed, well in place, and client’s sensitive data is appropriately secured.

Type of SOC2 Report:

SOC 2 audits constitute two types of audit reporting, namely SOC 2 Type 1 & SOC 2 Type 2. Both the types of reports are meant to tackle the reporting controls and processes of a service organization related to the five trust principles of data.

SOC 2 Type 1 Definition: SOC 2 Type 1 is a report on a service organization’s system and the suitability of the design of controls. The report describes the current systems and controls in place and review documents around these controls. Design sufficiency of all Administrative, Technical and Logical controls are validated.

SOC 2 Type 2 Definition: SOC 2 Type 2 Report is very similar to the Type 1 report, except that the evidence of control effectiveness are described and evaluated for a minimum of six months to see if the systems and control in place are functioning as described by the management of the service organization.