Glossary · S
SOC 2
SOC 2 is an attestation framework from the AICPA under which a CPA firm examines a service organization’s controls against the Trust Services Criteria and issues a confidential report.
Extended definition
In more detail.
A Type I report describes controls at a point in time; a Type II report tests them over a period, typically six to twelve months. The Security criteria are required; Availability, Processing Integrity, Confidentiality and Privacy are optional. The report is shared with customers under agreement rather than published. North American enterprise customers and SaaS buyers ask for it routinely.
In our work
Where it appears.
Evidence prepared under Compliance and Audit Readiness serves SOC 2 and ISO/IEC 27001 from one base. See the comparison.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days