The short answer
SOC 2 is an attestation report, under AICPA standards, in which a licensed CPA firm examines a service organisation's controls relevant to security, availability, processing integrity, confidentiality or privacy. It is not a certification. Type 1 covers design at a point in time; Type 2 covers design and operating effectiveness over a period.
What is SOC 2?
SOC 2 is an examination of a service organisation’s description of its system and of its controls relevant to security, availability, processing integrity, confidentiality or privacy. The professional standards are set by the American Institute of Certified Public Accountants (AICPA), and the criteria used are the 2017 Trust Services Criteria (with points of focus revised in 2022).
Is SOC 2 a certification?
No. It is an attestation report. SOC engagements are performed by licensed CPAs under the AICPA’s Statements on Standards for Attestation Engagements. So a supplier doesn’t hold a SOC 2 “certificate”; it has a SOC 2 report from an audit firm, covering a defined system.
What are the five Trust Services Criteria categories?
- Security
- Availability
- Processing integrity
- Confidentiality
- Privacy
A set of common criteria applies to all five categories. Security uses the common criteria only; the other four add criteria of their own. A report can cover one category or several, so check which ones a supplier’s report includes.
What is the difference between SOC 2 Type 1 and Type 2?
| Type 1 | Type 2 |
|---|---|
| Reports on the design of controls as of a specified date. | Reports on the design and operating effectiveness of controls throughout a specified period. |
How long is a SOC 2 Type 2 period?
Audit firms publish different guidance. Tevora gives a minimum of three months, a best-practice minimum of six and a maximum of twelve. Wolf & Company says twelve months is common, with a range of six to eighteen. Johanson LLP says a minimum of three months the first time and twelve months after that. Check the period stated in the report you are given.
What is a SOC 3 report?
A SOC 3 report is for general use and can be shared freely. It gives less detail than a SOC 2 report.
What should you check in a supplier’s SOC 2 report?
- Whether it is Type 1 or Type 2, and the date or period it covers.
- Which Trust Services Criteria categories are included.
- Which system and services are in scope, and whether the product you are buying is one of them.
- Which audit firm issued it.
For UK and international alternatives, see ISO/IEC 27001 and Cyber Essentials.
Sources
- AICPA: SOC 2
- AICPA: SOC 2 reporting guide
- AICPA: 2017 Trust Services Criteria (revised points of focus, 2022)
- AICPA: SOC 3
- Journal of Accountancy: quick-turn SOC engagements (April 2026)
- Journal of Accountancy: SOC credibility (February 2026)
- Johanson LLP: SOC 2 Type 1 vs Type 2 (March 2026)
- Tevora: how long a SOC 2 audit takes
- Wolf & Company: Type 1 vs Type 2 SOC reports
This is general information, not legal or professional advice. Rules change, so check the sources and take advice for your situation. Spotted something out of date? Email hello@asand.io.