SOC 2, explained for teams getting ready

SOC 2 is a reporting framework from the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm examines the controls at a service organization and reports on them against the Trust Services Criteria.

It is an attestation, not a certification. There is no SOC 2 certificate: you receive a report, which you share with customers, usually under a non-disclosure agreement.

• US enterprise customers, during vendor security reviews and procurement.
• Customers of SaaS and cloud companies that store or process their data.
• Investors and partners doing security due diligence.

No law requires SOC 2. Like ISO 27001, it becomes a requirement when customers ask for it.

Security, also called the Common Criteria (CC1 to CC9), is part of every SOC 2. You add the others based on what you promise your customers.

• Choose the scope: the systems in the report and the criteria beyond Security.
• Readiness or gap assessment: compare your controls with the criteria.
• Implement and document the missing controls.
• For Type II, run the controls through the observation period so they produce evidence.
• The CPA firm tests the controls and issues the report.
• Repeat each year: a Type II report covers a fixed period, so customers expect a current one.

• Access reviews not performed, or not evidenced, on schedule.
• Offboarding that leaves accounts active.
• Changes to production without documented approval and testing.
• No inventory or risk review of critical vendors.
• Security alerts that are generated but not monitored.
• Policies that exist but were never acknowledged by staff.

The free SwaSec SOC 2 assessment asks 13 questions across 11 domains and takes about 10 minutes. It scores where you stand and ties each gap to the clause, control or article it relates to.

• CC1: Control Environment. Commitment to integrity, ethical values, board oversight, and organizational structure.
• CC2: Communication and Information. Quality information generation, internal and external communication of control information.
• CC3: Risk Assessment. Risk identification, analysis, and consideration of fraud and change.
• CC4: Monitoring Activities. Ongoing monitoring and periodic evaluation of internal controls.
• CC5: Control Activities. Selection and deployment of control activities that mitigate risks.
• CC6: Logical and Physical Access. Access controls, authentication, and restriction of system access points.
• CC7: System Operations. Detection, response, and recovery from security events and incidents.
• CC8: Change Management. Controlled change management for infrastructure, data, software, and procedures.
• CC9: Risk Mitigation. Vendor risk management and business partner risk mitigation.
• A1: Availability. Additional criteria for availability commitments, redundancy, and disaster recovery.
• C1: Confidentiality. Additional criteria for identification and protection of confidential information.

Start the SOC 2 assessment. It is a self-assessment, not an audit or a certification.

SOC 2 shares 9 areas with the other frameworks SwaSec covers. Where it can, the assessment asks a shared area once, and the answer counts toward each framework.

• Security Policy, shared with ISO 27001, ISO 42001 and GDPR. Asked once.
• Risk Assessment, shared with ISO 27001, ISO 42001, GDPR and EU AI Act. Asked separately, because each framework wants something different.
• Access Control, shared with ISO 27001. Asked once.
• Incident Response, shared with ISO 27001 and GDPR. Asked once.
• Vendor/Supplier Management, shared with ISO 27001, ISO 42001 and GDPR. Asked once.
• Logging and Monitoring, shared with ISO 27001. Asked once.
• Change Management / Secure Development, shared with ISO 27001 and ISO 42001. Asked once.
• Training and Awareness, shared with ISO 27001 and ISO 42001. Asked once.
• Business Continuity and Recovery, shared with ISO 27001. Asked once.

• SOC suite of services, AICPA

This guide is general information, not legal advice. Last updated 1st October 2026.