SOC 2

Who has to comply

Voluntary and contractual. Technology and outsourced service providers obtain SOC 2 because customer security reviews, procurement policies and contracts require it; there is no legal mandate.

What you have to write

Documents on this site that SOC 2 requires or expects, each with who must have it, the review cycle and the obligations that cite it.

• Business Continuity and Disaster Recovery Plan Information security
• Incident Response Plan Information security

What the assessor asks to see

System description and management assertion; trust services categories in scope; policy set (information security, access control, change management, incident response, vendor management, business continuity, data classification and retention, acceptable use); risk assessment; control matrix mapped to criteria; populations and samples for user access, changes, incidents, vendors and hires; monitoring evidence (vulnerability scans, logging, backups, availability metrics); subservice organization reports; board or management oversight records.

Where the requirement sits: CC1.1 (integrity/ethics - code of conduct acknowledgment); CC1.4 (competence); CC2.2, CC2.3 (internal/external communication of policies); CC5.3 (policies and procedures)

Type 1 versus Type 2

Type 1 reports on whether controls are suitably designed and implemented at a single date. Type 2 reports on whether they also operated effectively throughout a period, with sample testing across that period. Buyers increasingly ask for Type 2, and many organizations skip Type 1 or use it only as a first milestone.