Skip to content
SecTepeMit Sicherheit gut aufgestellt!
DE
Glossary

SOC 2: Meaning, Type I and Type II, Criteria and Comparison with ISO 27001

What is SOC 2? The audit report explained simply: Trust Services Criteria, Type I and Type II, the process, validity and how it differs from ISO 27001.

Definition: SOC 2 (System and Organization Controls 2) is an audit framework of the American Institute of Certified Public Accountants (AICPA). An independent auditor assesses a service provider's controls for security, availability, processing integrity, confidentiality and privacy and records the result in an audit report.

What Is SOC 2?

Many companies hand their data to service providers: cloud vendors, software makers or data centers. They want to know if the data is safe there. A SOC 2 report answers this question. A CPA firm looks at the provider's controls and writes down what it tested and what it found.

A picture: ISO 27001 is like a quality seal for the whole security system. SOC 2 is more like a detailed expert report that describes each tested control and each test result one by one.

SOC 2 comes from the US, where many customers ask for it. That is why European vendors who sell in the US also get audited.

The Trust Services Criteria

The audit is based on the AICPA Trust Services Criteria. They have five areas:

  • Security: protection against unauthorized access. This area is always required.
  • Availability: the system can be reached as agreed.
  • Processing integrity: data is processed completely, correctly and on time.
  • Confidentiality: confidential information is protected.
  • Privacy: personal data is handled as the company has promised.

The company decides which areas to add beyond security. It picks the ones that matter to its customers.

SOC 2 Type I and Type II

Type I

The auditor checks whether the controls are designed correctly at a set date. This is faster and works well as a first step.

Type II

The auditor also checks whether the controls really worked over a period of time. The period is usually between three and twelve months. To do this, the auditor takes samples, such as records of access rights or proof of backups. Customers usually ask for this report.

SOC 1, SOC 2 and SOC 3

  • SOC 1: controls that matter for customers' financial reporting, for example at a payroll provider.
  • SOC 2: controls for security and the other Trust Services Criteria. A detailed report, usually shared only under NDA.
  • SOC 3: a short public version of the SOC 2 audit, for example for the website.

How a SOC 2 Audit Works

  1. Set the scope: which systems and which criteria are audited?
  2. Gap analysis: what is still missing compared to the criteria?
  3. Put controls in place: close gaps and collect evidence.
  4. Type I audit (optional): have the design of the controls checked at a set date.
  5. Observation period: run the controls in daily work and keep proof.
  6. Type II audit: the auditor assesses the period and writes the report.

After that, the audit is usually repeated every year.

SOC 2 and ISO 27001 Compared

  • Type: ISO 27001 is a standard with a certificate. SOC 2 is an audit report with an opinion.
  • Auditor: for ISO 27001, an accredited certification body. For SOC 2, a licensed CPA firm.
  • Content: ISO 27001 checks the whole management system. SOC 2 describes the single controls and test results in more detail.
  • Reach: ISO 27001 worldwide and above all in Europe, SOC 2 mainly in the US market.
  • Term: ISO 27001 certificates are valid for three years with yearly surveillance. SOC 2 reports are usually renewed every year.

Many controls overlap a lot. If you already have an ISMS to ISO 27001, you can reuse much of the evidence for SOC 2. In Germany, the BSI's C5 catalog is also widely used for cloud vendors.

Common Challenges

  • Evidence: for Type II, controls must be proven without gaps over months.
  • Effort: the CPA firm, internal work and tools cost time and money.
  • Several standards: if you also need ISO 27001, NIS-2 or the GDPR, you end up keeping a lot of things twice.

SOC 2 with SecTepe.Core

The multi-framework assessments in SecTepe.Core support SOC 2. Core maps controls to SOC 2, ISO 27001, NIS2 and other standards on its own. This way, you keep evidence once and use it for several audits.

Conclusion

SOC 2 is an audit report that shows how well a service provider protects its customers' data. Type II says more than Type I, because it proves that the controls worked over a period of time. For vendors in the US market, SOC 2 is often a must. In Europe, customers ask for ISO 27001 more often. Both can be built up well together.

FAQ about SOC 2

What is SOC 2 in simple terms?

SOC 2 is an audit report on the security controls of a service provider, such as a cloud or software vendor. An independent CPA firm checks whether the controls are well designed and, for Type II, whether they worked over a period of time. It is based on the Trust Services Criteria of the US accounting body AICPA.

Is there a SOC 2 certification?

Strictly speaking, no. People often talk about SOC 2 certification, but the result is not a certificate. It is an audit report with an auditor's opinion. A licensed CPA firm writes it, and it is usually only shared with customers under a non-disclosure agreement.

What is the difference between SOC 2 Type I and Type II?

Type I checks whether the controls are designed correctly at a set date. Type II also checks whether they actually worked over a period, usually three to twelve months. Customers usually ask for a Type II report because it tells them more.

What is the difference between SOC 2 and ISO 27001?

ISO 27001 is an international standard. An accredited certification body checks the whole management system and issues a certificate. SOC 2 is an audit report by a CPA firm under US standards. It describes the single controls and test steps in more detail. ISO 27001 is common worldwide and in Europe, SOC 2 mainly in the US market. Many controls overlap.

How long is a SOC 2 report valid?

A SOC 2 report has no fixed expiry date. It covers the period that was audited. But customers usually expect a recent report, so the audit is normally repeated every year.

Who needs SOC 2?

Mainly software and cloud vendors, data centers and other service providers that handle customer data and sell to companies in the US. There, a SOC 2 report is often a condition for signing a contract.

More terms in “Compliance & Regulation”

All terms in “Compliance & Regulation” →