Does SOC 2 mean secure?
A clean SOC 2 is evidence about the past, not a security rating.
Security teams often hear that a vendor has SOC 2 and close the review there. The report deserves more credit than a badge and less than a guarantee. It answers one question: did the controls this company chose and described pass an independent firm's sampled tests over a closed period? Its value and its limits both follow from that.
Back to SOC 2 services01 · Four fixed points
Four choices are fixed before testing starts
Know who made each one, and what lies outside it.
| Fixed point | Who sets it | What falls outside | Question for the vendor |
|---|---|---|---|
| The system | Management, in its description | Products, regions and teams left beyond the boundary | Which of your products are not covered? |
| The criteria | Management picks categories; the AICPA writes the criteria | Categories not chosen, such as Privacy or Processing Integrity | Why these categories and not the others? |
| The period | Management, agreed with the CPA firm | Everything after the last day | What has changed since the period ended? |
| The sample | The CPA firm | Occurrences that were never picked | How do you watch this control between audits? |
None of these choices is a trick. They are what make the work testable. They also mean the opinion is exactly as wide as the boundary management drew, which is why a careful reader checks the system description before trusting the verdict.
02 · Assurance level
Reasonable assurance, and where it stops
Reasonable is a defined level: high, yet short of certainty.
What it gives you
- An outside firm, held to professional independence rules, tested the controls
- Tests went beyond interviews, on samples the firm selected
- Findings were printed, deviations included
What it cannot give you
- Certainty that every occurrence worked, since only samples were examined
- Protection against collusion, honest error or a manager overriding a control
- Any statement about what happened after the period closed
The report admits this itself. Its inherent limitations paragraph warns that controls may not prevent or detect every error or act of fraud.
03 · Same criterion
Two vendors can pass one criterion at very different strengths
The criteria name outcomes; each vendor picks its own means.
The Trust Services Criteria describe what must be achieved and leave the method to the company. A modest control and a demanding one can both be judged suitable. The comparison below is invented to show how wide the gap can be.
| Criterion area | Vendor A (illustrative) | Vendor B (illustrative) |
|---|---|---|
| Logical access (CC6.1) | Password plus a one-time code, on the admin console only | Hardware-key sign-in on every route into production |
| Removing leavers (CC6.2, CC6.3) | Manager emails IT; access checked each quarter | Access ends automatically when HR closes the record |
| Spotting anomalies (CC7.2) | Alerts land in a shared inbox | Alerts page an on-call engineer with a response target |
| Change (CC8.1) | One approver on a ticket | A second engineer reviews the code and the author cannot release alone |
Both vendors could hold a clean opinion. The control wording in the test section of each report shows which one you are dealing with.
04 · After the period
Why a clean report and a later breach do not contradict each other
The opinion looks backward. Attackers look forward.
A breach months later may hit a system outside the boundary, use a weakness that appeared after the last day, or slip past a control that worked on every sampled occasion. None of these shows the auditor got it wrong. It shows the report was asked a wider question than the one it answers.
05 · Beside the report
What to request alongside it
Pair a historical report with current signals.
- A summary of the latest penetration test. No criterion names one. Ask when it ran, its scope, and how the findings were closed.
- The vulnerability backlog today. How many critical and high findings are open beyond the vendor's own fix target.
- Incidents since the period ended. Any security incident after the last day, and what changed because of it.
- A bridge letter. Management's word that nothing material changed since the period. Helpful, but nobody audited it.
- Coverage of new features. Products launched after the description was written are probably outside it.
06 · Where it counts
Where the report earns its weight
Its value lies in independence and disclosure.
- An outside firm, not the vendor, decided what to sample and how to test it
- Each in-scope criterion is tied to controls, and an unaddressed one would change the opinion
- Deviations are printed in full rather than summarised away
- The boundary is written down, so you can see precisely what you rely on
- The same layout each year lets you compare reports and spot repeat problems
Sources: AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy; AICPA AT-C section 205 (examination engagements), on reasonable assurance and inherent limitations; AICPA TSP section 100, Trust Services Criteria (CC6.1, CC6.2, CC6.3, CC7.2, CC8.1); AICPA DC section 200, 2018 Description Criteria.
Questions about SOC 2 and security
If a vendor with a clean SOC 2 is breached, was the auditor wrong?
Usually not. The report and the breach describe different moments.
The opinion covers sampled controls inside a finished period and a defined boundary. A breach can happen later, elsewhere, or through a gap no sample caught. Ask whether the affected system was in scope and when the event occurred.
Is a Type 1 report weaker evidence of security?
It shows design, not operation.
A Type 1 confirms the controls were suitably designed on one date. It says nothing on whether they kept running. If you want to rely on a vendor's controls day to day, a Type 2 is the stronger document.
Will the report tell us whether the vendor runs penetration tests?
Only if the vendor made it one of its controls.
No criterion requires one by name. If the description lists a yearly penetration test as a control, the firm checks it happened and the row appears in the results. Otherwise ask the vendor directly.
Can we drop our own security questionnaire when a vendor has SOC 2?
Shorten it rather than drop it.
Let the report answer the control questions it covers, then send only what it cannot: the current backlog, recent incidents and products outside the boundary.
Build controls that hold up under a harder question.
A SOC 2 readiness assessment helps you draw an honest boundary and choose controls that are strong, not merely enough to pass.