SOC 2
An AICPA attestation report in which an independent CPA examines a service organization's controls against the Trust Services Criteria.
Enterprise buyers often ask SaaS vendors for a SOC 2 report during procurement, so having one shortens security reviews, while reading one carefully helps a buyer judge a vendor's real controls.
A SaaS startup scopes security and availability, implements access reviews, logging and change management, completes a Type 1 report, then runs a 6-month observation period for a Type 2 report it shares with prospects under NDA.
SOC 2 is an attestation, not a certification, and covers only the systems, criteria and period in scope. Readers need to check exceptions, carve-outs and complementary user entity controls, not just the auditor's opinion.
SOC 2 engagements follow AICPA attestation standards and the 2017 Trust Services Criteria, which cover Security, required in every report, plus optional Availability, Processing Integrity, Confidentiality and Privacy. A Type 1 report assesses control design at a point in time; a Type 2 report also tests operating effectiveness over a period, often 6 to 12 months. Unlike ISO/IEC 27001:2022 it produces a CPA opinion rather than a certificate, and it is a common input to Third-Party Risk reviews.
Systems Architecture
AICPA & CIMA — SOC 2: SOC for Service Organizations: Trust Services Criteria — https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2; AWS — SOC FAQs — https://aws.amazon.com/compliance/soc-faqs/