Published October 21, 2026
What a SOC 2 report is
A SOC 2 report is a CPA's examination of a service organization's controls over security, availability, processing integrity, confidentiality or privacy. Customers and business partners often ask service organizations for one. SOC reports were established in 2011.
Three AICPA documents govern the work. The 2017 Trust Services Criteria (TSP section 100) set the outcomes controls must meet. The 2018 description criteria (DC section 200) set what management's description of the system must contain. The attestation standards, including AT-C section 105 and AT-C section 205, govern the examination. SSAE 21 applies to service auditor reports dated on or after June 15, 2022.
The criteria say what to achieve, not which controls to run. Each organization designs its own controls against its own risks.
Scope, categories and report type
The system. The description covers one system: its infrastructure, software, people, procedures and data. A narrow boundary is easier to describe and test.
The categories. The common criteria (CC1 to CC9) apply to every category. They cover the control environment, information and communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation. For security, the common criteria are the complete set. Availability, processing integrity, confidentiality and privacy each add their own criteria. TSP section 100 says security is addressed in most engagements; it does not make it mandatory. Add a category when customer contracts or questionnaires ask for it, not by default.
The type. A type 1 report covers the description and the suitability of control design. A type 2 report adds the operating effectiveness of controls throughout a specified period, with the auditor's tests and results.
The options
| Engagement | What it covers | What the reader gets |
|---|---|---|
| Readiness assessment | An internal or consultant review of controls against the Trust Services Criteria, before the examination. | A gap list for your own use. It is not a SOC 2 examination and carries no auditor's opinion. |
| SOC 2 type 1 | The description and the design of controls, as of a date. | An opinion on design. No tests of operating effectiveness. |
| SOC 2 type 2 | The description, design and operating effectiveness throughout a period. | An opinion on operating effectiveness, with each test and its results. |
| SOC 3 | Design and operating effectiveness, like a type 2. | A general-use report with an opinion but without the detailed tests. AWS, for example, publishes its SOC 3 openly. |
The AICPA criteria cited here set no fixed length for a type 2 period. Agree the period with your auditor, and ask your largest customers what they will accept before you fix it.
The order of the work
- Collect what customers have asked for. Questionnaires and contract clauses set the categories, the report type and the date.
- Define the system boundary. List the services in scope, the infrastructure and software behind them, the people who run them, and every vendor that performs controls for you.
- Run a readiness assessment. Map existing controls to each applicable criterion. Record gaps and give each an owner and a date.
- Write or fix policies and remediate. Check access reviews, change approvals, vendor reviews, incident response and risk assessment, which the common criteria all cover. A control that has not run yet cannot be tested.
- Choose the CPA firm and agree the scope. Settle the categories, the type, the period start, and how each subservice organization is treated.
- Draft the system description against DC section 200. Management writes it and asserts that it is presented in accordance with those criteria.
- Operate the controls and collect evidence through the period. For a type 2, every recurring control needs evidence for each time it ran.
- Support fieldwork and respond to exceptions. Prepare a management response for each exception the auditor finds.
- Plan the next period. Customers will want a current report. AWS and Microsoft, for example, issue SOC 2 reports twice a year, each covering the prior 12 months.
What takes longer than expected
- Evidence for recurring controls. Quarterly access reviews, monthly vulnerability scans and change tickets need records for every instance in the period. A missed instance cannot be recreated afterward.
- The system description. DC section 200 has nine criteria. They include principal service commitments, system components, incidents that caused a significant failure, and, for a type 2, significant changes during the period with dates.
- Criteria you think do not apply. Each criterion that is not relevant needs a stated reason. Outsourcing does not remove one. DC section 200 gives the example of a company hosted entirely on an infrastructure-as-a-service provider: CC6.5, on keeping protections over storage devices until their data can no longer be read or recovered, still applies even when that provider is carved out.
- Vendor risk management. CC9.2 requires the entity to assess and manage risks from vendors and business partners. If no vendor inventory exists, build one first.
The detail plans leave out
Subservice organizations. A subservice organization is a vendor that performs controls you depend on, such as a cloud host. Management chooses one of two methods for each, and can mix them.
- Carve-out. The vendor's controls are excluded from the description and from the examination. The description still names the services, the types of controls you assume the vendor runs (complementary subservice organization controls, or CSOCs), and the controls you use to monitor the vendor.
- Inclusive. The vendor's relevant controls are included in the description and are tested by the service auditor. Confirm the vendor will allow this before you choose it.
- Monitoring the vendor. Either way, the description discloses how you monitor the vendor. DC section 200 lists methods such as inspecting the vendor's type 2 SOC 2 report.
- Complementary user entity controls (CUECs). These are controls you assumed customers would run, without which your commitments would not be met. List only controls your own controls depend on. Ordinary customer duties are user entity responsibilities, not CUECs.
- Bridge letters. A bridge letter is a statement by the service organization's management, not the auditor, covering the gap between the end of the last report period and a later date. Google Cloud issues monthly bridge letters. Microsoft issues Azure letters quarterly. Expect customers to ask you for one between reports.
Choosing the CPA firm
SOC examinations are performed by CPAs under AICPA attestation standards. In February 2026 the AICPA's Journal of Accountancy reported that most new compliance tool providers are not CPA firms and cannot attest to controls. It also reported concerns that promises of fast, cheap SOC reports come at the expense of quality and objectivity.
- Check the firm's license with the state board of accountancy, or on CPAverify, NASBA's search of licensed CPAs and firms. NASBA reports 53 jurisdictions participate.
- Check the firm in the AICPA Peer Review Program public file. It shows enrollment status. Accepted peer review documents are public only for some firms.
- Ask how the firm keeps its independence from any tool vendor that referred you.
- Ask about the firm's capacity and for client references at companies like yours.
Skills and operations
SOC 2 is run by control owners, not by the compliance lead alone. Each control needs a named owner who performs it on schedule and keeps the record.
Build an evidence calendar from the control list: what runs weekly, monthly, quarterly and yearly, and where each record is kept. Review it monthly so a missed control is found inside the period, not at fieldwork.
After the first report, each year brings a new period, new vendor reports to inspect and bridge letters to issue.
Settle these first
- Which customers need the report, by what date, and will they accept a type 1 first?
- Which trust services categories do your contracts and questionnaires actually require?
- Where does the system boundary sit, and which vendors perform controls inside it?
- Will each subservice organization be carved out or included, and does that vendor publish a type 2 report?
- Who owns each control, and who collects the evidence?
- Is the CPA firm licensed and peer reviewed, and is it independent of the tools you use?
Questions
- What is the difference between SOC 2 Type 1 and Type 2?
- A type 1 report covers the system description and whether controls are suitably designed. A type 2 adds whether controls operated effectively throughout a specified period, and lists the auditor's tests and results.
- Is the Security category mandatory in SOC 2?
- The common criteria apply to every category. TSP section 100 says security is addressed in most engagements and that, although uncommon, an examination may leave it out.
- Who can issue a SOC 2 report?
- A CPA performs the examination under AICPA attestation standards. Check the firm's license with the state board or on CPAverify, and its peer review in the AICPA public file.
- What are complementary user entity controls?
- Controls that the service organization assumed its customers would run, and that are necessary with its own controls for its commitments to be met.