SOC 2

What it is

SOC 2 (Service Organization Control 2) is a reporting framework developed by the American Institute of Certified Public Accountants (AICPA). It is not a certification, not a law, and not enforced by any government agency, it is an independent auditor's report on a service organization's controls relevant to the Trust Services Criteria (TSC). It has become a de facto market requirement for enterprise B2B SaaS and cloud service providers.

Who it applies to

Any service organization whose services could impact user entities' financial reporting, security, or trust. Common adopters include SaaS platforms, cloud infrastructure providers, managed service providers, data processors, and any organization whose customers require independent third-party attestation of control effectiveness.

Key provisions

Trust Services Criteria

• Security (Common Criteria, required): Protection against unauthorized access (physical and logical), unauthorized disclosure, and damage to systems
• Availability: System is available for operation and use as committed
• Processing Integrity: System processing is complete, valid, accurate, timely, and authorized
• Confidentiality: Information designated as confidential is protected as committed
• Privacy: Personal information is collected, used, retained, disclosed, and disposed of in accordance with the entity's privacy notice

The Security TSC is mandatory in every SOC 2 examination. The other four are optional and selected based on the service organization's commitments to user entities.

Type 1 vs Type 2 reports

• Type 1: Auditor's opinion on the design of controls as of a specific date. Point-in-time snapshot.
• Type 2: Auditor's opinion on the design AND operating effectiveness of controls over a period of time (typically 6-12 months). Standard for mature vendor due diligence.

Type 2 reports are what enterprise procurement teams typically require; Type 1 is often the initial step for organizations pursuing their first SOC 2.

The Common Criteria (CC series)

Under the 2017 Trust Services Criteria (revised 2022 points of focus), Security is organized into nine Common Criteria series:

• CC1, Control Environment: Integrity, ethics, governance, competence
• CC2, Communication and Information: Internal and external communication
• CC3, Risk Assessment: Identification and analysis of risks
• CC4, Monitoring Activities: Ongoing and separate evaluations
• CC5, Control Activities: Design and deployment of control activities
• CC6, Logical and Physical Access Controls: Restrict access appropriately
• CC7, System Operations: Detect and respond to threats
• CC8, Change Management: Authorize, design, develop, implement changes
• CC9, Risk Mitigation: Identify, select, and develop risk mitigation activities

Breach handling within SOC 2

SOC 2 has no statutory breach-notification deadline, obligations are contractual, flowing through the Master Services Agreement (MSA), Data Processing Addendum (DPA), and any applicable Business Associate Agreement. However, CC7 controls typically require:

• Documented incident response plan
• Timely detection and response to security incidents
• Notification of user entities per contractual commitments
• Post-incident analysis and corrective action

Auditor selection and scope

SOC 2 examinations must be performed by a licensed CPA firm. The auditor selects a sample of controls to test based on materiality and risk. Report scoping, what systems, services, and time periods are covered, is negotiated between the service organization and auditor and disclosed on the report cover page.

Recent amendments

• Mar 20182017 Trust Services Criteria became effective, replaced the 2014 TSC.
• Jun 2022AICPA published updated points of focus for the 2017 TSC, same criteria, refreshed implementation guidance.

How LeakTrace maps to it

An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to SOC 2, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.