It usually arrives as one line in a security questionnaire, or an email from procurement: please provide your SOC 2 report. For a company that has never had one, it is not obvious what is being asked for, who provides it, or how long it takes.
What a SOC 2 report is
SOC 2 is an attestation report, not a certification. An independent CPA firm audits your controls against the AICPA’s Trust Services Criteria and writes a report describing your system, your controls and the results of its testing. Your customer reads that report to decide whether to trust you with their data.
Nobody “passes” SOC 2 the way you pass an inspection. The report can be clean, or it can list exceptions, and a sophisticated customer will read the exceptions.
The criteria
The Trust Services Criteria cover five categories:
- Security is required in every SOC 2 report.
- Availability, processing integrity, confidentiality and privacy are optional, and you include the ones that matter to what you sell.
Most first reports cover security alone, or security plus availability or confidentiality.
Type I or Type II
- A Type I report looks at whether your controls are designed properly, at a single point in time.
- A Type II report tests whether those controls actually operated over a period, commonly several months up to a year.
Many companies start with a Type I to have something to show quickly, then move to Type II. Most large customers will eventually want the Type II, so it is worth asking your customer up front which one they will accept.
Where the work actually is
The audit is the short part. The work is everything before it: deciding which controls apply, closing the gaps (access reviews, MFA, logging, change management, vendor reviews, incident response, written policies), and then running those controls consistently and keeping the evidence that proves it.
That is where companies stall. The auditor’s gap list tells you what is missing, in language that assumes you already know how to fix it.
Where to start
- Ask your customer which report type and which criteria they need, and by when.
- Scope the system: which products, data and people are in the audit.
- Run a readiness assessment against the criteria and fix the gaps.
- Pick a CPA firm and agree the audit period.
TenacIT is not a CPA firm and does not issue SOC reports. We do the readiness work, run the controls and collect the evidence, and stay for the annual cycle. If you have been asked for a SOC 2 report, book a 30-minute call and we will tell you honestly how far away you are. More detail: SOC 2 readiness.
This article is general information, not legal or audit advice for your situation.