SOC 2
Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy
Overview
SOC 2 (System and Organization Controls 2) is a framework developed by the American Institute of CPAs (AICPA) that defines criteria for managing customer data based on five trust service principles: security, availability, processing integrity, confidentiality, and privacy.
SOC 2 reports are unique to each organization as they require companies to establish and follow strict information security policies and procedures, encompassing the security, availability, processing integrity, confidentiality, and privacy of customer data.
These reports are increasingly important for service providers, particularly those that store customer data in the cloud, as they demonstrate the organization's commitment to data security and privacy.
Key Requirements
- Establish and maintain security policies and procedures
- Implement access controls to protect against unauthorized access
- Monitor systems for security events and incidents
- Conduct risk assessments and vulnerability management
- Ensure secure software development practices
- Implement change management procedures
- Maintain backup and disaster recovery processes
Frequently Asked Questions
- Governing Body:
- American Institute of CPAs (AICPA)
- Type:
- Attestation Report
- Audit Frequency:
- Varies
- Report Types:
- Type I (point-in-time) and Type II (period of time)
- Trust Principles:
- Security, Availability, Processing Integrity, Confidentiality, Privacy
- SaaS (Software as a Service) providers
- Cloud computing vendors
- Data centers and hosting providers
- Managed IT service providers
- Financial technology companies
- Healthcare technology organizations
- Any organization that stores, processes, or transmits customer data
SOC 2 Readiness Assessment
Comprehensive evaluation of your current security posture against SOC 2 requirements to identify gaps and develop a remediation plan.
Policy and Procedure Development
Creation of customized security policies and procedures aligned with SOC 2 requirements and your business operations.
Control Implementation
Assistance with implementing the necessary technical and organizational controls to meet SOC 2 requirements.
Pre-Audit Preparation
Thorough preparation for your SOC 2 audit, including evidence collection, documentation review, and mock audits.
Remediation Support
Expert guidance and support to address any gaps or deficiencies identified during the assessment or audit process.
How Much Will SOC 2 Cost You?
Find out what Type 1 vs Type 2 really costs — and where the hidden expenses are. Answer 7 questions, get an instant estimate.
Related Resources
Tools, templates, and articles for SOC 2 compliance
Cost Calculator
SOC 2 Cost Calculator
Estimate your SOC 2 compliance costs based on company size, current posture, and timeline.
Identity Security
Non-Human Identity Security: Your Access Review Covers 1% of Your Identities
Machine identities outnumber humans 100:1, OWASP ranks improper offboarding as the top non-human identity risk, and only 21% of organizations have a process to decommission an AI agent. How to extend the access review you already built.
Audit Preparation
What Auditors Actually Ask About AI in a SOC 2 or ISO 27001
There is no AI module for SOC 2. The same criteria now point at systems that did not exist when you wrote your controls. The six AI questions assessors ask and the evidence that answers them.