SOC 2
System and Organization Controls 2
SOC 2 (System and Organization Controls 2) is a compliance framework and audit report developed by the AICPA that evaluates how well a service organisation protects customer data. Assessments are based on five Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy — and are especially important for SaaS and cloud providers.
A SOC 2 report comes in two forms. A Type I report assesses whether controls are suitably designed at a single point in time, while a Type II report tests whether those controls operated effectively over a period — typically three to twelve months. Type II carries the most weight with enterprise buyers.
Because SOC 2 is tailored to service organisations that store customer data in the cloud, it has become a near-standard requirement in SaaS procurement. Many companies pursue it alongside ISO 27001, reusing much of the same underlying control set.
Practical context
Using SOC 2 in a real decision
Definitions are most useful when they help a team decide what to scope, who should own the work, and what evidence supports the next step. Use these questions to turn the term into a practical conversation.
- Which customers, data, services, or contracts make this requirement relevant?
- What controls and evidence would demonstrate that the requirement is operating in practice?
- Who is accountable for the scope, reviews, and any remediation work?