SOC 2 compliance: Trust Services Criteria, Type I vs Type II and the audit

SOC 2 is an independent attestation report, issued by a licensed CPA firm, on the controls a service organization uses to protect the system that delivers its service. The controls are measured against the AICPA Trust Services Criteria for security, and optionally availability, processing integrity, confidentiality and privacy. SOC 2 is not a certification. You receive a report with the auditor's opinion.

For SaaS and cloud companies that sell to US businesses, a current SOC 2 Type II report is often the document that unblocks a deal. This guide explains what the framework requires, what the report looks like, how auditors test controls and how to plan your first audit. It relies on AICPA publications, linked in the sources at the end.

What is SOC 2?

SOC stands for System and Organization Controls. The American Institute of Certified Public Accountants (AICPA) defines a family of SOC reports:

• SOC 1 covers controls relevant to a customer's financial reporting, such as a payroll or billing service.
• SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality or privacy. It is meant for customers, their auditors and regulators who understand the system, and it is usually shared under a nondisclosure agreement.
• SOC 3 covers the same criteria as SOC 2 in a short general-use report that you can publish on your website.

A SOC 2 examination is performed under the AICPA attestation standards (AT-C section 105 and 205). The CPA firm examines management's description of the system and the controls in it, and gives an opinion on whether the description is fair and the controls are suitably designed (Type I), and also operated effectively over a period (Type II). The criteria used are the Trust Services Criteria (TSP section 100) and the description criteria (DC section 200).

Is SOC 2 mandatory or voluntary?

SOC 2 is voluntary. No law requires a company to have a SOC 2 report. It becomes required in practice when:

• A customer's procurement or vendor risk policy lists a current SOC 2 Type II report as a condition of signing or renewing.
• A customer's own auditors or regulators need assurance about the services it outsources to you, for example in financial services or healthcare.
• A contract requires you to deliver a new report every year and a bridge letter in between.

Who needs a SOC 2 report?

SOC 2 is designed for service organizations, meaning companies that provide a service to other organizations using systems that could affect those customers' data or operations. Typical examples:

• SaaS companies of every kind, including HR, finance, marketing, analytics, developer tools and learning platforms.
• Cloud infrastructure, hosting, data center and managed service providers.
• Payment, payroll and fintech platforms (often with a SOC 1 as well).
• Data processors, call centers and outsourced IT or software development firms that hold customer data.
• Healthcare technology vendors, which often combine SOC 2 with HIPAA mapping.

Customers do not need a SOC 2 for themselves. They need one from you, so that their own risk teams can rely on your controls.

Why does SOC 2 matter for SaaS and IT companies?

• Sales. Many US enterprise buyers will not finish procurement without a Type II report, and a report often replaces a long custom questionnaire.
• Renewals. Customers who rely on your report ask for a new one every year. An expired report can delay renewals.
• Their audits. Your customers' auditors use your report to understand the controls at their service providers, including the complementary controls the customer must run on its side.
• Operational discipline. Preparing for a Type II forces repeatable processes, such as access reviews, change approvals and incident handling, that need to run every month, not once.

A SOC 2 report is a statement about the past, for a defined system and period. It does not guarantee future security, and a report with exceptions can still be acceptable to customers if the exceptions are explained and fixed.

What are the five Trust Services Criteria?

The Trust Services Criteria are organized into five categories. Security is always included. You choose the others based on what you promise customers.

Most first-time SaaS reports cover security, often with availability and confidentiality. Privacy is chosen less often, because it is detailed and many companies act as processors for their customers rather than collecting data from individuals directly.

What do the SOC 2 common criteria require?

The security category is made up of the common criteria, numbered CC1 to CC9. CC1 to CC5 follow the 17 principles of the COSO 2013 Internal Control framework. CC6 to CC9 add criteria specific to technology and security.

Each criterion comes with points of focus. Points of focus describe important characteristics of a criterion. They are not requirements that must each be met, but auditors use them to judge whether your controls address the criterion. The AICPA revised the points of focus in 2022 to reflect changes in technology, risks and regulation. The criteria themselves did not change.

What is the difference between SOC 2 Type I and Type II?

The AICPA does not set a minimum Type II period. Many companies start with a shorter first period, such as three to six months, then move to a rolling 12-month period so that each new report follows the last with no gap. A common path is a Type I to satisfy early customers, followed by a Type II period that starts once the controls are running.

What is in a SOC 2 report?

A SOC 2 Type II report usually has these sections:

1. The independent service auditor's report. The CPA firm's opinion. An unmodified (clean) opinion means the description is fairly presented and the controls were suitably designed and operated effectively. A qualified opinion means one or more criteria were not met. Adverse opinions and disclaimers are rare.
2. Management's assertion. Your written statement that the description is fair and the controls met the criteria.
3. The description of the system. Written by you under DC section 200: the services, the infrastructure, software, people, procedures and data, the principal service commitments and system requirements, relevant aspects of the control environment, incidents during the period, subservice organizations and complementary controls.
4. The criteria, controls, tests and results. Each criterion with the controls that address it, the auditor's test procedures and the results, including any exceptions.
5. Other information (optional). Management's responses to exceptions, or extra material the auditor did not examine.

Subservice organizations and complementary controls

Most SaaS companies rely on a cloud provider such as AWS, Microsoft Azure or Google Cloud. In the report, these are subservice organizations. Usually they are carved out: your report states which controls you expect the provider to run, called complementary subservice organization controls, and you show that you review the provider's own SOC 2. The report also lists complementary user entity controls, which are the controls your customers must run, such as managing their own users' access.

What training evidence does a SOC 2 audit test?

The Trust Services Criteria do not set a training frequency or a list of topics. Training appears through several criteria, and auditors test it as a control you define:

• CC1.4 asks that the entity demonstrates a commitment to attract, develop and retain competent individuals. Points of focus include evaluating competence and providing training, mentoring and other development.
• CC2.2 asks that the entity internally communicates information, including objectives and responsibilities for internal control. Security awareness training and policy acknowledgment are the usual controls here.
• CC1.1 covers integrity and ethical values, commonly evidenced by a code of conduct that new staff acknowledge.
• CC6 and CC7 controls, such as secure development and incident response, often rely on role-based training for engineers and responders.

Whatever control you write, the auditor will test it as written. If your control says "all new hires complete security awareness training within 30 days of start and all personnel complete it annually", the auditor will pick a sample of new hires and current staff from the period and ask for each person's completion date. A late or missing completion becomes an exception in the report.

How does the SOC 2 audit process work?

1. Choose a CPA firm. Only licensed CPA firms can issue a SOC 2 report. Firms vary in size, industry experience and price. Ask for sample reports and their approach to testing.
2. Decide scope. Agree which services, systems, locations and Trust Services Criteria categories are in scope, and which vendors are subservice organizations.
3. Readiness assessment (optional but common). The firm or an advisor reviews your controls against the criteria and lists gaps. A firm that performs readiness work must still keep its independence for the examination.
4. Fix gaps and start operating controls. For a Type II, the period only starts once the controls are in place.
5. Fieldwork. The auditor requests a population list for each control (for example all new hires, all production changes, all terminated users), picks samples and asks for evidence. They also interview staff and observe some activities.
6. Exceptions and responses. Any failures are noted. You can add management responses explaining causes and fixes.
7. Report issued. The final report goes to you, and you share it with customers under NDA.
8. Bridge letters and renewal. Between the end of a period and the next report, you can give customers a bridge letter (also called a gap letter). It is your statement, not the auditor's, that nothing material has changed.

How do you prepare for a SOC 2 audit step by step?

1. Collect customer requirements. Which categories do your buyers ask for? Do they want Type II only? Which period end suits your sales cycle?
2. Write the system description early. It forces you to define the boundaries of the system, the data and the commitments you make.
3. Write policies that match practice. Information security, access control, change management, incident response, vendor management, business continuity, acceptable use, data classification and retention.
4. Set up the people controls. Background checks where lawful, confidentiality agreements, a code of conduct, onboarding and annual security awareness training, and offboarding checklists.
5. Tighten access. Single sign-on, MFA, role-based access, quarterly access reviews for production and key SaaS tools, and same-day removal for leavers.
6. Control change. Pull request review, automated tests, separation between who writes and who approves production changes, and records of emergency changes.
7. Monitor and respond. Centralized logs, alerts on important events, a vulnerability management process with timelines, a yearly penetration test and a tested incident response plan.
8. Manage vendors. A vendor inventory, risk ratings, and yearly review of key vendors' SOC 2 reports.
9. Run a mock sample. Pick five new hires, five changes and five leavers from last quarter and try to produce the evidence. Fix whatever you cannot find.

How long does SOC 2 take and what affects the cost?

A Type I can be reached once your controls are designed and in place. A Type II needs the controls to run for the whole period you choose, plus fieldwork and report writing, so the first Type II report often arrives several months after you start the period. What drives cost and time:

• Categories in scope. Each extra category adds criteria and testing.
• System complexity. Number of products, environments, locations and in-house infrastructure.
• Report type and period. A Type II with a 12-month period needs more sampling than a Type I.
• Auditor choice. Fees differ between firms and depend on their testing approach.
• Your starting point. Remediation work, such as adding SSO or logging, often costs more than the audit itself.
• Tooling. Compliance automation tools can collect evidence from cloud and HR systems, which reduces manual work during fieldwork.

Ask more than one CPA firm for a proposal that states the categories, report type, period and fee.

How do you read a vendor's SOC 2 report?

SOC 2 also matters when you are the customer. CC9.2 expects you to assess and manage risks from vendors and business partners, and an auditor will ask how you reviewed the reports of your own key vendors, such as your cloud provider, identity provider and payment processor. A practical review covers:

1. Report type and period. Is it a Type II? Does the period end within the last 12 months? If there is a gap to today, ask for a bridge letter.
2. Scope. Does the system description cover the service you actually use, and the regions or data centers your data sits in?
3. Categories. If you rely on the vendor for uptime, is availability in scope? If they hold your confidential data, is confidentiality in scope?
4. The opinion. Is it unmodified? If it is qualified, read which criteria were not met and why.
5. Exceptions. Read every exception in the test results and management's response. Decide whether any affect your use of the service.
6. Complementary user entity controls. List the controls the vendor expects you to run, such as reviewing your own users' access or enabling MFA, and assign each one to an owner in your company. These often become controls in your own report.
7. Subservice organizations. Note which providers are carved out and whether you need their reports too.

Record the review with a date, the reviewer, conclusions and follow-up actions. That record is the evidence your own auditor will sample.

Choosing your own auditor

When you select a CPA firm, ask how many SOC 2 examinations it performs for companies like yours, who will do the fieldwork, how it handles evidence requests and tooling, how long report issuance takes after the period ends, and whether its reports are widely accepted by the customers you sell to. Confirm that the firm is licensed and that it will stay independent if it also helps you with readiness.

What are common SOC 2 exceptions?

• New hires who completed security awareness training after the deadline in the control, or not at all.
• Annual training not completed by everyone in the period, especially contractors and long-term leave returners.
• Access reviews done late, or done without evidence that inappropriate access was removed.
• Terminated employees whose accounts stayed active after their last day.
• Production changes deployed without the required review or approval.
• Vulnerabilities fixed outside the timelines in your own policy.
• Vendor reviews skipped for a key vendor.
• Incident response plan not tested in the period.
• Background checks missing for some hires, where the control requires them.

Nearly all of these are failures to follow your own written control. The fix is usually to automate the reminder and the record, and to write the control at a level you can meet.

How does SOC 2 compare with ISO 27001?

Both prove that a company manages security, and their controls overlap heavily. The main differences are in form and market.

The AICPA publishes mappings from the Trust Services Criteria to ISO 27001, NIST frameworks and others, so one set of controls can support both audits. Related frameworks you may meet in SOC 2 work:

• SOC 1 if your service affects customers' financial reporting.
• HIPAA for health data. Some firms issue a SOC 2 with additional HIPAA criteria, sometimes called SOC 2+.
• CSA STAR, whose level 2 attestation is a SOC 2 that also covers the Cloud Controls Matrix.
• NIST CSF 2.0 as a way to structure your security program.

What is changing in SOC 2?

In October 2026 the AICPA's Assurance Services Executive Committee released exposure drafts of proposed 2027 Trust Services Criteria and updated description criteria, described as intended to improve the relevance, clarity and usability of the criteria. These are proposals. Until the final versions are published and take effect, SOC 2 examinations continue to use the 2017 Trust Services Criteria with the revised points of focus from 2022 and DC section 200. We will update this guide when the AICPA finalizes the changes and announces an effective date.

Other changes worth tracking:

• The 2022 SOC 2 guide updated the AICPA's guidance for the auditors who perform these examinations, alongside the revised points of focus and implementation guidance for the description criteria.
• AI in scope. Customers increasingly ask how AI features handle their data. The current criteria already apply to AI components inside your system boundary, and you may need to describe them in the system description.

Key SOC 2 terms

Service organizationThe company whose system is examined, such as a SaaS vendor. User entityA customer of the service organization. Trust Services Criteria (TSC)The AICPA criteria used to evaluate controls, in five categories. Points of focusCharacteristics that help judge whether a criterion is met. Not each one is required. ExceptionA test where the auditor found a control did not operate as described. Carve-out methodExcluding a subservice organization's controls from the report and relying on its own report. CUECComplementary user entity control: a control the customer must run for the system's controls to work. Bridge letterA letter from management covering the gap between the end of the last report period and today.

SOC 2 FAQs

Official sources and references

We checked these sources while writing and reviewing this guide. Where a rule is a proposal or a draft, the guide says so.

• AICPA, SOC 2: SOC for Service Organizations, Trust Services Criteria Overview of SOC 2 and report users
• AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022) TSP section 100, the criteria used in current reports
• AICPA, Description criteria for a SOC 2 report (DC section 200) What the system description must contain
• AICPA, SOC 2 Guide: Reporting on an examination of controls at a service organization 2022 edition of the auditor guide
• AICPA, Exposure drafts: proposed 2027 SOC 2 Trust Services Criteria and description criteria Proposals released October 2026, not yet final
• AICPA, Mapping the 2017 Trust Services Criteria to NIST SP 800-53 Official mapping, useful for multi-framework programs

Next steps

1. Ask your top three prospects which SOC 2 categories and report type they need, and by when.
2. Draft the system description: services, boundaries, data and subservice organizations.
3. Write your training control with a deadline you can always meet, and include contractors.
4. Run a mock sample of new hires, changes and leavers from last quarter. Book a demo to see how LMS Advisor exports training evidence by date range.
5. Request proposals from two or more licensed CPA firms.