SOC 2
An AICPA attestation report in which an independent CPA examines a service organization's controls against the Trust Services Criteria.
Enterprise buyers often ask SaaS vendors for a SOC 2 report during procurement, so having one shortens security reviews, while reading one carefully helps a buyer judge a vendor's real controls.
A SaaS startup scopes security and availability, implements access reviews, logging and change management, completes a Type 1 report, then runs a 6-month observation period for a Type 2 report it shares with prospects under NDA.
SOC 2 is an attestation, not a certification, and covers only the systems, criteria and period in scope. Readers need to check exceptions, carve-outs and complementary user entity controls, not just the auditor's opinion.
SOC 2 engagements follow AICPA attestation standards and the 2017 Trust Services Criteria (with points of focus revised in 2022), which cover Security, required in every report, plus optional Availability, Processing Integrity, Confidentiality and Privacy. A Type 1 report assesses control design at a point in time; a Type 2 report also tests operating effectiveness over a period, often 6 to 12 months. Unlike ISO/IEC 27001:2022 it produces a CPA opinion rather than a certificate, and it is a common input to Third-Party Risk reviews.
Systems Architecture
AICPA & CIMA — System and Organization Controls: SOC Suite of Services — https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services; AWS — SOC FAQs — https://aws.amazon.com/compliance/soc-faqs/