What is SOC 2? Explained simply

The problem SOC 2 solves

When a business hands its data to a service provider, it takes on that provider's risks. It cannot walk in and test the provider's access controls, so it asks for an independent report. In the United States that report is usually a SOC 2.

SOC stands for System and Organization Controls. A SOC 2 report is the written result of an examination, performed by a licensed Certified Public Accountant (CPA), of the controls a service organization uses to protect the systems it runs for customers.

The examination follows the attestation standards of the American Institute of Certified Public Accountants (AICPA), and the controls are judged against the AICPA's Trust Services Criteria, published as TSP section 100. That is the AICPA's own definition, from the terms for its SOC logo.

So a SOC 2 is not a security standard you install. It is an outside accountant's opinion on whether your controls, as you described them, are designed well and, for a Type 2, worked over a period. The intended reader is your customer and your customer's auditors.

What SOC 2 actually asks of you

Three things. A written description of your system, prepared to the AICPA's description criteria (DC section 200, the 2018 edition with implementation guidance revised in 2022). A signed assertion from management that the description is fair and the controls do what it says.

And evidence that the controls meet the Trust Services Criteria for every category you put in scope.

The criteria in force are the 2017 Trust Services Criteria with points of focus revised in 2022. The AICPA's notice to readers says the 2022 changes revised the points of focus, which are guidance on reading each criterion, and did not alter the criteria in any way. There is no 2025 edition.

Security is the common criteria and is in every report; you add the other four when your commitments to customers depend on them.

Notice what is missing: a list of required controls. The criteria say what must be achieved, not how. You choose the controls, write them into the description, and the auditor tests the controls you chose.

Two companies with clean reports can run very different security programs, which is why a buyer reads the report and not just the cover.

What SOC 2 is not

Not a certification. The AICPA issues no certificate, keeps no register of SOC 2 holders, and neither licenses nor accredits the firms that do the work. "SOC 2 certified" means the company has a report; ask for it.

Not a law. We found no statute or regulator that requires a SOC 2. Customers and contracts do.

Not proof of legal compliance. A clean opinion says your controls met the criteria for the categories in scope. It says nothing about HIPAA, the GDPR, PCI DSS or any privacy law; the privacy category tests you against your own notices and commitments.

Not permanent. Each report covers a date or a period. Nothing renews it; you have a new examination and get a new report.

Not something a software platform can grant. Readiness tools collect evidence and track policies. Only a licensed CPA firm can examine and sign, and in 2026 the AICPA's ethics staff told its members that the examination fee must be set by the auditor, and that a tool provider driving the deadline or the scope is a threat to the auditor's independence.

Type 1, Type 2 and how the process runs

The AICPA's logo terms define the two report types and its report review checklist gives the timing. A Type 1 reports on management's description and on whether the controls are suitably designed to meet the company's principal service commitments and system requirements, as of a date.

A Type 2 covers the same description and adds whether the controls operated effectively throughout a period. Buyers usually want a Type 2 because it shows the controls worked, not just that they existed one day.

Short first periods of a few months are common practice and twelve months is the norm once a company is on an annual cycle, but those are practice, not rules. The AICPA's report review checklist asks the buyer whether the period is long enough and recent enough to be useful, which is the real test.

You can also ask for a SOC 3 at the end of the same examination. The AICPA describes it as a general-use report that omits the system description and the test detail, so it can be published.

A worked example

Take an illustrative company: twenty people, a scheduling product sold to clinics, hosted with a large cloud provider, and a lost deal because the prospect asked for a SOC 2 Type 2 and there was none.

They scope the scheduling platform and the staff who touch it. Security is in by default. They add availability because contracts promise 99.9 percent uptime and confidentiality because clinic data sits under confidentiality clauses.

They leave out privacy because the clinics, not the company, decide how patient data is used.

Over a few months they write down the policies they never had, turn on multi-factor authentication, review access quarterly, add an approval step to deployments and track laptops. The description names the cloud provider as a carved-out subservice organization with its own SOC 2 report.

They engage a licensed CPA firm and agree a six-month period. The auditor samples access reviews, changes, hires and incidents. One access removal was late, so the report shows an exception with management's response.

The opinion is unmodified. A year later they repeat it with a full-year period.

The buyer sees the categories, the period, the carved-out provider, the one exception, and the two things clinics must do themselves: control who has logins and patch their own devices. That is what the deal turned on.

Who does what

Nobody sits above the CPA firm handing out approvals. The quality levers are state licensing, peer review and the profession's code of conduct.

One myth to retire: there is no "AICPA-accredited" or "AICPA-approved" SOC 2 auditor. The AICPA's ethics staff list "AICPA-approved" as a misstated credential in their April 2026 guidance. Membership is voluntary; the license comes from a state board.

How to read and verify a SOC 2 report

The AICPA's report review checklist for buyers opens with a blunt note: only a licensed CPA firm can issue a valid SOC 2 report. So start with the firm. Check its permit on the register of the state board printed on the report, and look up its enrollment and latest accepted review in the AICPA peer review public file.

Then read the report, which has a standard shape.

The opinion comes in four forms, set by the attestation standard for examinations (AT-C section 205). Unmodified: the controls met the criteria in all material respects. Qualified: a material problem, or a limit on evidence, that was not pervasive, so the opinion carries an "except for" clause.

Adverse: material and pervasive problems. Disclaimer: too little evidence for any opinion. There is no pass or fail label, and a qualified opinion is not a pass with notes; it is a real carve-out to read and price.

In practice an adverse or disclaimed opinion is a fail for procurement.

A report with exceptions is not automatically bad. The AICPA checklist asks how critical the failed control was, whether it led to an incident, whether management's response was detailed, and whether the same exception appeared last year.

Expect a nondisclosure agreement. The AICPA's logo terms restrict use of a SOC 2 report to user entities, their auditors and others with the requisite understanding of the service organization. The public artifacts are a SOC 3 and the SOC logo, which a company may display for twelve months after the report date.

Between reports, vendors offer a bridge letter. No AICPA standard defines it. In practice it is a letter from management, not the auditor, saying whether controls changed since the period ended.

The AICPA checklist treats it only as cover for a timing gap, never as a substitute for the next report.

What it costs and how long it takes

The AICPA publishes no fee schedule and no standard timeline, and this site does not print averaged estimates. The cost has several parts and only one is the audit.

The examination fee is set by the CPA firm using its own judgment. The AICPA's ethics staff said in April 2026 that a fee set or packaged by a tool provider, or one the provider can change alone, can impair independence. If a bundled price includes "the audit", ask who set that number.

The rest is readiness: your staff's time, any adviser, any evidence software, penetration testing if your controls call for it. Scope drives all of it: more categories, systems, locations and people mean more controls and more samples.

On time, a Type 2 period cannot be compressed, and readiness takes as long as your gaps require. In February 2026 the AICPA's Journal of Accountancy, reporting the views of the chair of the AICPA's SOC 2 Working Group, described promises of a report in weeks or even hours as the warning sign, not the goal.

What changed in 2025 and 2026

The criteria did not change. TSP 100 is still the 2017 criteria with 2022 points of focus, DC 200 the 2018 criteria with 2022 guidance, and the guide the October 15, 2022 edition. Pages advertising new 2025 criteria are misreading a web page date.

The examination standards did. SSAE No. 23 aligns the attestation standards with the AICPA's quality management standards and is effective for engagements beginning on or after December 15, 2025, so reports from engagements started after that date come from firms that must run a documented system of quality management.

The AICPA also went public about quality. A notice on its SOC landing page says it is looking into anonymously published allegations about a compliance vendor offering SOC services and will act against members who skipped standards or peer review.

On February 1, 2026 its Journal of Accountancy carried a warning from the SOC 2 Working Group chair about tool vendors promising "compliance" in weeks, referral networks of small firms and templated reports.

On April 13, 2026 the AICPA's ethics staff issued guidance on arrangements between auditors and SOC 2 tool providers, naming referral concentration, provider-driven deadlines, bundled fees, pay-to-access evidence, non-disparagement clauses and "100 percent pass" marketing as threats needing documented safeguards or a declined engagement.

On May 14, 2026 the Peer Review Board told reviewers to sample several SOC 2 engagements per firm and treat identical risk assessments, sample sizes and procedures across clients as nonconforming.

Further ahead, the Auditing Standards Board issued exposure drafts on February 26 and March 25, 2026 to revise the baseline attestation sections with stronger evidence and risk assessment requirements. Comments closed June 30, 2026; the proposed effective date is for engagements beginning on or after June 15, 2029.

They are proposals, and they do not touch the Trust Services Criteria.

Five questions for a proposed auditor follow: Which licensed firm signs, in which state? When was your last peer review accepted? Who sets your fee and deadline? Are the risk assessment and samples tailored to my system? How much of the testing is inquiry alone? The AICPA checklist says inquiry alone is not appropriate without inspection, observation or reperformance.

Where it leads next

Once a company is on an annual cycle, three paths open. Broaden scope, adding privacy or processing integrity as commitments grow. Run a SOC 2+ examination, which the 2022 guide added an illustrative report for, so the auditor reports against additional criteria in the same engagement.

Or add ISO 27001, which buyers outside the United States often ask for alongside a SOC 2; it is a certification issued by an accredited certification body, so the two documents say different things and are checked differently. Our ISO 27001 page explains the contrast.

History in one line: the SOC 1, 2 and 3 names arrived in 2011 with SSAE No. 16 as the replacement for SAS 70, the criteria were rewritten in 2017, and the points of focus were revised in 2022.

What we could not verify

The full text of TSP 100 and DC 200 sits behind a free AICPA account; we read TSP 100 from the AICPA's red-lined copy on its own content server, which is where the criteria counts come from, and DC 200 from its summary page. The SOC 2 guide is a paid publication, so we rely on its product page and do not repeat what the guide says about Type 2 period length.

The April 2026 ethics guidance is behind the same account, so we used the Journal of Accountancy's write-up, which the AICPA links from its SOC page. We could not open NASBA's CPAverify search today. No AICPA document we read sets a minimum Type 2 period; three-month and six-month figures elsewhere are market practice.