SOC 2 Trust Services Criteria: A Practical GRC Guide
An overview of the AICPA Trust Services Criteria, SOC 2 examinations, scope, evidence and the difference between an attestation report and certification.
Key Takeaways
- ✓SOC 2 uses Trust Services Criteria for a defined service and system.
- ✓The selected categories should reflect commitments, risks and intended users.
- ✓Type 1 addresses control design at a point in time; Type 2 also addresses operating effectiveness over a period.
- ✓Management owns the system description, assertions and control environment.
- ✓A SOC 2 report is an attestation report, not a certification or guarantee.
What SOC 2 addresses
SOC 2 engagements use the AICPA Trust Services Criteria to evaluate controls relevant to security, availability, processing integrity, confidentiality and privacy. The applicable categories depend on the service organization's commitments and system description. The criteria are used by an independent CPA practitioner to perform an examination and issue a report; they are not a prescriptive implementation checklist for every organization.
Define the system and objective
Begin with the service, system boundary, locations, infrastructure, people, data flows, subservice organizations and customer commitments in scope. Select the relevant Trust Services Categories based on risks and obligations, and describe the system consistently. A Type 1 examination addresses the design of controls at a point in time; a Type 2 examination also evaluates operating effectiveness over a specified period. The report type and period must be clear to intended users.
Build evidence and governance
Map commitments and risks to control activities, owners, frequencies and retained evidence. Establish processes for access management, change control, incident response, availability, vendor oversight and data handling where applicable to the chosen categories. Monitor exceptions throughout the examination period and retain records that show who performed each control, when, and how deviations were resolved. Management remains responsible for the system description and its assertions.
Decisions and measures
Track in-scope controls with evidence coverage, exceptions by severity, remediation aging, recurring issues, vendor dependencies and control performance over the period. Use readiness work to identify gaps, but distinguish internal preparation from the independent examination. Restrict report sharing according to the report's intended-use terms and customer agreements.
Boundaries
A SOC 2 report is an attestation report, not a product certification, universal security rating or guarantee that no incident will occur. It covers a defined system, criteria and period. A clean result does not eliminate the need for customer due diligence, ongoing monitoring or a separate assessment of requirements outside the examination scope.
Frequently asked questions
Is SOC 2 a certification?
No. SOC 2 is an independent attestation examination and report over a defined system, criteria and period.
What is the difference between Type 1 and Type 2?
Type 1 addresses control design at a point in time. Type 2 also evaluates operating effectiveness over a specified period.
Does a SOC 2 report prove that a company is secure?
No. It reports on the defined scope and period; it is not a guarantee and does not cover requirements outside that scope.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
Related Content
NIST CSF 2.0: Cybersecurity Outcomes
NIST CSF 2.0 organizes cybersecurity outcomes into six Functions and helps communicate, prioritize and assess efforts without prescribing one implementation.
ISO/IEC 27001: Information Security Management System
ISO/IEC 27001 specifies requirements for establishing, maintaining and improving an ISMS whose scope and risk treatments are defined in organizational context.