What Is SOC 2? A Definitive Guide

SOC 2 is an independent examination of a service organization’s controls against the AICPA’s Trust Services Criteria. The resulting report helps customers assess how a provider protects information and manages risks within the services examined.

IBM’s 2026 Cost of a Data Breach Report puts the global average breach cost at $4.99 million, highlighting the financial stakes of protecting customer data. SOC 2 gives customers documented evidence to support their vendor evaluations.

This guide explains SOC 2 requirements, report types, and the steps involved in preparing for an examination.

What Does SOC 2 Stand For?

SOC stands for System and Organization Controls, and SOC 2 identifies the AICPA’s reporting service for examining a service organization’s controls against the Trust Services Criteria. The American Institute of Certified Public Accountants uses this terminology for its suite of assurance services.

Each part of the name describes an element of the assessment.

1. S: System

The system includes the infrastructure, software, people, procedures, and data used to deliver the services being examined. Defining this system establishes the assessment boundary and helps customers understand which services the report covers.

2. O: Organization

The organization is the service provider responsible for operating the system. Its management establishes policies, assigns responsibilities, evaluates risks, and oversees the controls supporting service delivery and information protection.

3. C: Controls

Controls are the policies, procedures, and technical safeguards used to address risks and meet defined objectives. Examples include access approvals, system monitoring, incident response procedures, and reviews of software changes.

What the Number 2 Means

The number 2 identifies the SOC reporting category covering controls relevant to security, availability, processing integrity, confidentiality, or privacy. The examination’s scope determines the categories covered.

It does not represent a security maturity level or automatically indicate a Type 2 report.

SOC 2 focuses on controls related to security, availability, processing integrity, confidentiality, and privacy, with reports used to demonstrate how an organization’s systems and practices address these trust service criteria.

What Is SOC 2 Compliance?

SOC 2 compliance is the commonly used term for implementing controls that meet the applicable AICPA Trust Services Criteria and undergoing an independent examination.

A licensed CPA firm issues a SOC 2 report describing the assessed system and its conclusions about the controls. SOC 2 is an attestation report, rather than a certification.

The Trust Services Criteria are organized into five categories:

1. Security addresses protection against unauthorized access, disclosure, and damage to systems and information.
2. Availability addresses whether systems are available for operation and use according to the organization’s commitments and objectives.
3. Processing Integrity addresses whether processing produces complete, valid, accurate, timely, and authorized results.
4. Confidentiality addresses protection of information designated as confidential throughout its lifecycle.
5. Privacy addresses the collection, use, retention, disclosure, and disposal of personal information.

The applicable criteria depend on the examination’s scope. Organizations should select coverage that reflects their services, commitments, and customer needs.

Preparing for a SOC 2 examination typically involves these steps:

1. Define the scope. Identify the services, systems, people, data, and external dependencies covered by the examination.
2. Select the applicable criteria. Determine which Trust Services categories address the organization’s commitments and risks.
3. Implement and document controls. Assign responsibilities, establish procedures, and correct gaps between existing practices and the applicable criteria.
4. Collect supporting evidence. Maintain records such as access reviews, change approvals, monitoring results, and incident response activities.
5. Complete the independent examination. A Type 1 examination evaluates the system description and control design as of a specified date. A Type 2 examination additionally evaluates operating effectiveness throughout a specified period.
6. Address findings and maintain controls. Review reported exceptions, implement corrective actions, and update controls as systems and risks change.

A SOC 2 report helps customers assess the risks of using a provider’s services. Its usefulness depends on the report’s scope, examination period or date, auditor’s opinion, and findings.

What Are SOC 2 Controls?

SOC 2 controls are the policies, procedures, and technical safeguards an organization implements to address risks and meet the applicable Trust Services Criteria.

Organizations design controls around their services, systems, risks, and commitments. SOC 2 does not prescribe an identical control checklist for every company.

Common examples include the following measures:

• Access Management: Organizations approve access, review user permissions, and remove access when employees leave or change roles.
• Authentication: Multi-factor authentication helps protect accounts against unauthorized use.
• Data Protection: Encryption and information-handling procedures protect sensitive data during storage and transmission.
• Monitoring and Incident Response: Teams review security alerts, investigate suspicious activity, and follow documented response procedures.
• Change Management: Teams review, test, and approve changes before deploying them to production systems.
• Backup and Recovery: Organizations maintain backups and test restoration procedures to support recovery objectives.

These controls are evaluated against criteria within the selected Trust Services categories: security, availability, processing integrity, confidentiality, and privacy. The categories define the assessment areas; the controls describe what the organization does to address them.

For practical examples and implementation considerations, read the SOC 2 controls guide.

Types Of SOC 2 Reports

There are two types of SOC 2 reports: SOC 2 Type I and SOC 2 Type II, and they differ based on the time period and depth of evaluation. SOC 2 Type I evaluates whether a company’s controls are properly designed at a specific point in time, while SOC 2 Type II evaluates both the design and operating effectiveness of those controls over an extended period, usually three to twelve months.

SOC 2 Type I is commonly used to demonstrate initial control readiness, while a SOC 2 Type II report is generally required by customers and partners because it provides evidence that controls consistently operate over time.

What’s the Difference Between SOC 2 Type I Vs Type II?

SOC 2 Type I is a point in time report on whether controls are designed and implemented, while SOC 2 Type II also tests whether those controls worked over a defined period.

1. Choose Type II when customers or their auditors ask for proof that controls worked across a period, not only on a single date.
   
2. Choose Type I when you need an earlier snapshot to confirm the control set exists and is implemented, then plan a move to Type II after controls have run long enough to generate period evidence.
   
3. Pick a Type II period length that matches expectations, since periods commonly range from a few months for a first report to a full year in many programs. 

For a deeper side-by-side breakdown, see our full guide on SOC 2 Type 1 vs Type 2 compliance.

Who Needs A SOC 2 Report?

A SOC 2 report is typically needed by any service provider that stores, processes, or transmits customer data and must give customers detailed assurance about the controls that protect that data.
Organizations that most often need a SOC 2 report include:

1. SaaS and cloud application providers that host customer data or run critical customer workloads.
2. Managed service providers such as IT outsourcing, monitoring, and security operations vendors that access customer environments or data.
3. Cloud infrastructure and hosting providers such as data centers, platform providers, and services that support customer systems and availability commitments.
4. Data processors and business platforms such as analytics, identity, HR, payroll, and customer support systems that handle confidential or personal information.
5. Vendors selling to regulated or risk sensitive buyers where customers and business partners use SOC 2 reports as part of their risk review of service providers.

Vendors selling to regulated or risk sensitive buyers, where SOC 2 for enterprise clients becomes part of every vendor risk review.

You may need a SOC 2 report depending on your business model and customer requirements, and our blog on who needs SOC 2 compliance explains whether your organization falls into that category.
your organization falls into that category.

What Is A SOC 2 Audit?

A SOC 2 audit is an independent review that examines whether a company has designed and follows controls that protect customer data and critical systems. The audit is performed by a licensed CPA or SOC 2 audit firm and measures controls against the Trust Services Criteria.

A SOC 2 audit typically includes:

1. Scope definition, which identifies the systems, services, and data included in the audit.
2. Control review, which evaluates whether security, availability, processing integrity, confidentiality, and privacy controls are properly designed.
3. Evidence testing, which involves reviewing logs, records, and other proof that controls operate as described.
4. Audit reporting, which results in a formal SOC 2 report that customers and partners can review.

SOC 2 audits are issued as either Type I reports, which assess control design at a specific point in time, or Type II reports, which evaluate how well controls operate over a defined period, usually several months.

How Much Does a SOC 2 Audit Cost?

A SOC 2 audit typically costs between $15,000 and $100,000+, with most small to mid-sized businesses spending $20,000 to $50,000 depending on scope and complexity.

Costs vary based on audit type and organization size. Type 1 audits usually range from $15,000 to $30,000 for SMBs, while Type 2 audits cost more at $30,000 to $70,000+ due to extended testing periods.

Larger enterprises often exceed $100,000 due to broader systems and multiple trust criteria.

Total SOC 2 costs increase when adding readiness assessments, remediation, compliance tools, and security testing, which can push first-year spending significantly higher than the audit fee alone.

Teams working with tight budgets can also review our playbook on budget-friendly SOC 2 compliance before scoping the project.

Learn what drives SOC 2 audit pricing and what to expect at each stage in our detailed guide on SOC 2 audit costs.

Who Can Perform A SOC Audit? 

A SOC audit must be performed and the SOC report must be issued by an independent licensed CPA, typically through a CPA firm acting as the service auditor. 

A SOC examination is an AICPA attestation engagement under the SSAEs and is tied to AICPA professional and ethical requirements, including independence standards reflected in the required independent practitioner reporting language. 

A readiness assessment or prep work can be supported by consultants, but a consultant cannot sign or issue the SOC report. 

A practical qualifier is that the firm should be a public accounting firm that participates in the AICPA peer review program, since peer review is how the profession evaluates quality for audit and attestation work. 

SOC 2 Audit Checklist

A SOC 2 audit checklist organizes the scope, system description, controls, and evidence needed for an independent examination. It should reflect the organization’s services, risks, and applicable Trust Services Criteria.

Evidence requirements depend on the controls being assessed and whether the engagement is Type I or Type II.

The following checklist provides a practical starting point for preparation.

1. Engagement Scope and Report Requirements

• Report Type: Confirm whether the engagement will produce a SOC 2 Type I or Type II report.
• Reporting Date or Period: Establish the specified date for Type I or the examination period for Type II.
• Trust Services Categories: Document the categories included in the examination and the applicable criteria.
• System Boundary: Identify the services, environments, locations, people, and technology included in scope.
• Subservice Organizations: Identify external providers that perform relevant functions or controls.
• Reporting Method: Agree on the carve-out or inclusive treatment of relevant subservice organizations.
• Customer Responsibilities: Identify complementary user entity controls that customers must implement, where applicable.
• Management’s Assertion: Prepare management’s written assertion about the system description and controls.
• Report Components: Plan for the system description, management’s assertion, and independent service auditor’s report. Type II reports include the auditor’s tests of controls and results.

2. System Description Inventory

Management prepares the system description using the AICPA’s SOC 2 Description Criteria. It should explain how the assessed services operate and the boundaries of the examination.

• Services Provided: Describe the services covered by the report and their intended users.
• System Components: Document the infrastructure, software, people, procedures, and data supporting those services.
• Information Flows: Map relevant data movement, interfaces, and dependencies.
• Commitments and Requirements: Identify service commitments and system requirements relevant to the selected categories.
• Controls: Describe the controls supporting those commitments and requirements.
• External Dependencies: Explain subservice organization responsibilities and relevant complementary subservice organization controls.
• Significant Events: Evaluate significant system incidents and changes for inclusion in the description.
• Scope Limitations: Explain relevant exclusions and any criteria considered inapplicable.

3. Common Criteria Evidence Inventory

The Common Criteria, CC1 through CC9, cover governance and operational safeguards. The examples below are preparation aids; each organization should map its actual controls to the applicable criteria.

AICPA guidance allows judgment in control design and does not require every point of focus to become a separate control.

4. Additional Category Evidence

Examinations covering categories beyond Security need evidence addressing their additional criteria.

• Availability: Prepare capacity monitoring, backup restoration results, and recovery testing records.
• Processing Integrity: Document input validation, processing checks, error handling, and output reconciliation.
• Confidentiality: Maintain information classification, retention, access restriction, and disposal records.
• Privacy: Prepare evidence supporting privacy notices, consent where applicable, data handling, individual requests, and disclosure practices.

5. Evidence Quality and Readiness Checks

• Ownership: Assign a responsible person to each control and evidence request.
• Timing: Confirm that records relate to the required assessment date or reporting period.
• Traceability: Identify the system, control, reviewer, and relevant date associated with each record.
• Completeness: Reconcile evidence populations before the auditor selects samples.
• Exceptions: Document missed activities, control failures, and corrective actions.
• Secure Sharing: Use an approved repository with appropriate access restrictions for audit evidence.

How AI Can Affect SOC 2 Compliance

Artificial intelligence affects SOC 2 compliance when it changes how an organization processes information, operates controls, or relies on external providers.

Organizations should evaluate AI use within the assessed system and update risk assessments, system descriptions, and controls where necessary. The applicable safeguards depend on the service commitments, data involved, and examination scope.

AI governance is becoming an important operational consideration. Gartner’s survey of 360 organizations, conducted in 2025 and published in 2026, found that organizations using AI governance platforms were 3.4 times more likely to achieve high effectiveness in AI governance.

This finding concerns AI governance effectiveness, rather than SOC 2 audit outcomes.

The following areas deserve attention when AI supports an in-scope service:

• Data Handling: Identify information submitted to models, retained in prompts, or included in generated outputs. Review restrictions on sensitive data and whether external providers use customer information for model training.
• Access Management: Restrict access to AI applications, service accounts, API keys, datasets, and administrative functions according to assigned responsibilities.
• Vendor Oversight: Evaluate external model providers and AI platforms for data retention, security commitments, incident notification, and relevant assurance coverage.
• Change Management: Review and approve material changes to models, prompts, integrations, and automated workflows. Retain evidence of testing before deployment.
• Logging and Monitoring: Capture records needed to investigate failures, unauthorized activity, and consequential automated actions. Protect sensitive information within those logs.
• Output Validation: Define acceptable performance and human review where AI outputs affect service commitments. Monitor accuracy or model drift when those measures address identified risks.

Processing Integrity does not automatically establish that an AI system is unbiased or explainable. Its criteria address whether processing is complete, valid, accurate, timely, and authorized.

Fairness and explainability require evaluation against the organization’s specific commitments and applicable obligations.

AI-assisted compliance tools require scrutiny of their own. Generated policies, summaries, and evidence mappings need review against actual activities and source records.

Management remains responsible for its controls, and the independent CPA firm remains responsible for the examination. AICPA guidance highlights independence and audit-evidence risks involving SOC tool providers.

For implementation considerations, read SOC 2 for AI startups.

Why SOC 2 Compliance Is Important

SOC 2 gives customers and business partners independent assurance about controls within a defined service environment. A Type II report evaluates whether those controls operated effectively during the examination period, helping buyers assess the risks of trusting a provider with their data.

The following factors explain why these controls matter.

1. Breach Costs Make Security a Business Priority

IBM’s 2026 Cost of a Data Breach Report puts the global average breach cost at $4.99 million. Recovery expenses, investigations, and lost business can turn a security incident into a major financial setback.

Preparing for SOC 2 helps organizations assign control owners, document risks, and establish repeatable security processes. The practical value comes from maintaining those controls and correcting weaknesses identified during reviews.

2. Operational Disruption Makes Recovery Planning Essential

Service outages can interrupt customer transactions, employee workflows, and access to essential information. Documented change management, monitoring, and incident response procedures help organizations manage these risks.

When Availability is included in the SOC 2 scope, additional criteria address capacity management, recovery infrastructure, and recovery testing. The selected controls should reflect the organization’s service commitments and system requirements.

3. Third-Party Relationships Create Security Dependencies

Verizon’s 2025 Data Breach Investigations Report found third-party involvement in 30% of breaches. Vendors, cloud providers, and other partners can introduce exposure through their access, services, or handling of sensitive information.

A SOC 2 program supports defined vendor responsibilities, risk reviews, and oversight. Customers can use a provider’s report to examine relevant controls, understand service dependencies, and identify responsibilities they must manage themselves.

4. Ransomware Makes Layered Protection Important

Ransomware appeared in 44% of breaches reviewed in Verizon’s 2025 report. This highlights the importance of controls that address unauthorized access, vulnerable systems, and incident response.

SOC 2 evaluates relevant controls against applicable criteria. Organizations select safeguards suited to their risks, such as access restrictions, vulnerability management, and security monitoring. A report does not guarantee protection against ransomware or prescribe one required security product.

5. Monitoring and Response Need Clear Ownership

Collecting security logs provides limited value without people and procedures to investigate suspicious activity. Teams need defined responsibilities for reviewing alerts, escalating concerns, containing incidents, and tracking corrective actions.

SOC 2 preparation helps organizations document these activities and retain evidence of their execution. Type II testing examines whether relevant controls operated effectively throughout the reporting period, giving customers assurance beyond written policies alone.

Our SOC 2 statistics show how adoption, buyer expectations, and audit costs shape compliance decisions.

SOC 2 Requirements

SOC 2 requirements center on the AICPA Trust Services Criteria, the system being examined, and the organization’s service commitments. Organizations select and implement controls appropriate to those requirements and their risks.

Security forms the foundation of a SOC 2 examination. Availability, Processing Integrity, Confidentiality, and Privacy are included according to the engagement’s scope.

Key preparation areas include:

1. Defined Scope and System Description: Describe the services, boundaries, infrastructure, software, people, procedures, and data covered by the examination. Identify relevant external service dependencies. AICPA & CIMA
2. Documented Commitments and Control Mapping: Connect service commitments and system requirements to applicable criteria. Identify the controls and owners responsible for addressing them.
3. Logical and Physical Access Controls: Manage access approvals, authentication, permissions, access removal, and protection of relevant facilities and equipment.
4. Controls for Selected Additional Categories: Address requirements specific to the categories included in scope, such as recovery testing for Availability or restricted information handling for Confidentiality.
5. Change Management: Establish procedures for reviewing, testing, approving, and deploying changes to systems and applications.
6. Monitoring and Vulnerability Management: Identify security weaknesses, evaluate unusual activity, and track corrective work.
7. Incident Response: Define responsibilities for investigating, escalating, containing, resolving, and communicating security incidents.
8. Vendor Risk Management: Evaluate relevant providers, document responsibilities, and review risks associated with outsourced services.
9. Evidence Appropriate to the Report Type: For Type I, support control design and implementation as of a specified date. For Type II, retain evidence demonstrating operation throughout the examination period.
10. Management Assertion and Independent Examination: Prepare management’s assertion and engage an independent licensed CPA firm to perform the examination and issue the SOC 2 report.

Read our detailed guide to SOC 2 requirements for more information about preparation and supporting documentation.

What Are Access Control Models?

Access control models define how systems determine who can access a resource and which actions they can perform. These models base authorization on ownership, centrally enforced policies, assigned roles, attributes, or relationships.

They help organizations limit access according to business responsibilities and security requirements.

NIST describes DAC, MAC, RBAC, and ABAC through its access control guidance. OpenFGA documents ReBAC through relationships among users and resources.

Organizations can combine models to meet different authorization needs. For example, role assignments can establish general permissions while attribute checks restrict access based on device status or location.

Bright Defense Helps You Get SOC 2 Compliant

Bright Defense helps organizations prepare for SOC 2 examinations and maintain security controls through a monthly continuous compliance program.

Its services combine readiness assessments, remediation support, managed compliance automation, and security leadership to support ongoing audit preparation.

Bright Defense’s SOC 2 support covers the following activities:

• Readiness and Gap Assessments: Evaluate existing practices against applicable Trust Services Criteria and identify areas requiring corrective work.
• Risk Assessment and Control Implementation: Assess security risks, support control implementation, and develop policies and procedures that reflect business operations.
• Compliance Monitoring and Evidence Preparation: Use managed compliance automation to track status and support evidence collection throughout the agreed Type II examination period.
• Remediation Support: Help teams address control gaps, document corrective actions, and track outstanding work.
• Security Leadership and Employee Training: Provide virtual Chief Information Security Officer (vCISO) guidance, security awareness training, and phishing simulations.

SOC 2 preparation should follow the examination period agreed with the independent CPA firm. That period defines the operating history reviewed in a Type II report and is separate from the time needed to complete audit fieldwork and reporting.

Learn more about Bright Defense’s SOC 2 compliance services.

FAQs

1. What Is SOC 2, and How Is AICPA Involved?

SOC 2 is an examination and reporting framework developed by the American Institute of Certified Public Accountants (AICPA). It allows independent CPA firms to evaluate a service organization’s controls against applicable Trust Services Criteria and issue an assurance report.

2. What Is the Difference Between SOC 2 Type I and Type II?

A Type I report evaluates the system description and suitability of control design as of a specified date. A Type II report covers a defined period and includes testing of control operating effectiveness. Type II provides evidence about how controls functioned over time.

3. What Are the Four Types of Audits?

There is no universal classification limited to four audit types. Common categories include internal, external, financial, and compliance audits, although these overlap. Internal and external describe who performs the audit, while financial and compliance describe its purpose.

4. What Is a SOC 2 Assessment?

A SOC 2 assessment can refer to a readiness review or a formal examination. A readiness assessment identifies gaps in controls, policies, and evidence before the audit. A formal examination is performed by an independent CPA firm and results in a SOC 2 report.

5. What Does SOC 2 Evaluate?

SOC 2 evaluates a service organization’s system description and controls against applicable Trust Services Criteria. Security is included in every SOC 2 examination. Availability, Processing Integrity, Confidentiality, and Privacy are selected according to the service commitments and scope.