One examination, read by every customer who would otherwise audit you.

Any business that runs part of its operation on a vendor's platform inherits that vendor's risk. A bank cannot inspect every software supplier it uses, and a supplier cannot host fifty separate audits a year. The AICPA (the American Institute of Certified Public Accountants) designed its SOC reports to break that deadlock. The vendor is examined once, and the result travels to each customer who needs it.

SOC now stands for System and Organization Controls. The number signals the audience. SOC 1 serves customers whose financial statements depend on your processing. SOC 2 serves customers who care how you protect and run the systems holding their data. SOC 3 is a short, public version of the SOC 2 result.

The firm must be independent of you. An adviser who helped design your controls, Auditify included, can prepare you but cannot be the one who signs. The auditor's own rules are the AICPA attestation standards: AT-C 105, which applies to all attestation work, and AT-C 205, which governs examinations.

• Security (always included)
• Availability
• Confidentiality
• Processing integrity
• Privacy

The criteria describe what good looks like, such as restricting logical access or spotting anomalies, and leave the method to you. Security, also called the common criteria, is part of every SOC 2. The other four categories join the scope only when they match promises you make to customers. An uptime commitment, for instance, pulls in Availability.

1. 1TSP section 100The criteria themselves, issued in 2017. In 2022 the AICPA updated the explanatory points of focus while leaving the criteria intact.
2. 2DC section 200A separate set of criteria for the system description: what management must disclose about services, infrastructure, people, data and commitments.
3. 3Your own controlsNo authority publishes a fixed list. Two companies can satisfy one criterion in different ways, as long as each control is designed well and leaves evidence.

1. Type 1
   Design on a dateThe auditor gives a view on the description and on whether the controls were sound and in place on one single day. Nothing about how they performed over time is tested.
2. Type 2
   Design plus a track recordThe same conclusions, plus testing of samples drawn from across a defined review window to show the controls ran consistently.
3. SOC 3
   The public summaryA general-use report on the same examination, without the detailed test results. Good for a website; rarely enough for a security reviewer.

When a form says only 'SOC 2', the reviewer usually wants a Type 2. Our Type 1 or Type 2 guide covers how to choose.

1. The CPA firm's opinion, naming the system, the categories in scope, and the date or window covered.
2. Management's assertion: the signed claim the auditor set out to test.
3. The system description you wrote against DC 200, including what customers must do on their side (the complementary user entity controls).
4. In a Type 2, every control with the test applied and the result, with any deviations described.
5. Optionally, unaudited material such as management's comments on those deviations.

Because the detail could help an attacker, the report is intended for readers who understand it: you, your customers and prospects, and their auditors. Most vendors share it under a non-disclosure agreement. Our guide to reading a SOC 2 report shows what reviewers look at first.

1. 1Your buyers are large or regulatedBanks, insurers, health systems and listed companies must show their own auditors and regulators how they oversee suppliers. Your report goes into that file.
2. 2You hold or touch customer dataHosting, processing, analysing or supporting data on a customer's behalf places your controls inside their risk.
3. 3You hold privileged accessManaged IT and security providers with administrator rights in client environments get asked early.
4. 4A deal is waitingThe most common trigger of all: a security review that cannot close without an attested report.

Starting before the request lands matters most for a Type 2, because its evidence window has to run its full course. No report can arrive sooner than the end of the window it covers.

• 'Our product is secure'. The opinion covers named controls for a named date or window. It gives reasonable assurance, not a promise that no breach will happen.
• 'We are certified'. An attestation ends in an opinion. Nobody issues a SOC 2 certificate.
• 'Our compliance tool made us SOC 2'. Software can organise evidence. Only the CPA firm's examination yields a report.
• 'Privacy in scope means we meet GDPR'. The Privacy criteria test your notice and practices against the criteria, not your standing under any data protection law.

Sources: AICPA, TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (revised points of focus, 2022); AICPA, DC section 200, 2018 Description Criteria; AICPA attestation standards AT-C section 105 and AT-C section 205; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy.

• A SOC 2 attestation, explainedWhat an attestation is, who may give one, and what you may call the result.
• The AICPA attestation standards, mappedHow SSAE 18, the AT-C sections and the SOC suites fit together.
• Your first framework: SOC 2 or ISO 27001?A decision path by market, buyer and team.