SOC 2 is a report from an independent CPA firm on the controls a service organisation uses to protect customer data and run its systems. In India people search for "SOC 2" when a customer, usually a large or overseas one, asks a software or outsourcing company to prove its controls. The report gives that proof. It is an attestation, not a certificate.
Last reviewed: 17 October 2026. Facts checked. We opened the AICPA-CIMA page on the SOC suite of services, which confirms the suite and the five areas. We also searched AICPA material for Type 1 and Type 2 and the criteria documents. The page did not define Type 2, so that definition is common usage and we did not confirm AICPA's wording. We did not read the SOC 2 guide, and we did not check audit fees or timelines.
What SOC 2 is
The AICPA describes SOC as a suite of services CPAs provide on system-level controls of a service organisation. The SOC 2 report covers controls relevant to five areas:
| Category | Plain meaning |
|---|---|
| Security | The system is protected from unauthorised access |
| Availability | The system is available as committed |
| Processing integrity | Processing is complete, valid, accurate and timely |
| Confidentiality | Confidential information is protected |
| Privacy | Personal information is handled as promised |
Security is the base for most reports. The company chooses which other categories to include, usually based on what customers ask for. For what auditors test inside each, read SOC 2 trust services criteria.
AICPA material refers to two sets of criteria: the 2017 trust services criteria (with points of focus revised in 2022) and the 2018 description criteria, which govern how the system is described.
SOC 1, SOC 2 and SOC 3
SOC 1 is about controls that matter to a customer's financial reporting. SOC 2 is about the trust services categories. SOC 3 is a shorter report for general use. The page we opened did not describe SOC 1 or SOC 3, so see our explainer, SOC 1 vs SOC 2 vs SOC 3, for the full comparison.
Type 1 and Type 2
An AICPA-hosted discussion states that in a Type 1 the service auditor evaluates controls as of a specific date. A Type 2 is generally understood to test whether the controls operated over a period of time.
| Type 1 | Type 2 | |
|---|---|---|
| Looks at | Design at one date | Design and operation over a period |
| Evidence | Documents, configuration, walkthrough | Samples across the period |
| Customer comfort | Lower | Higher, which is why customers often ask for it |
| When used | A first report | Following reports and repeat cycles |
Who needs it
You need a SOC 2 report when your customers need assurance about systems you run for them. Typical cases:
- A software-as-a-service company selling to larger or overseas buyers.
- A data centre, hosting or cloud provider.
- An outsourced finance, payroll or support provider handling customer data.
SOC 2 is not a legal requirement in itself. It is driven by the customer contract or the buyer's vendor review. If a customer asks about ISO 27001 instead, read ISO 27001 vs SOC 2.
How a SOC 2 audit works
- Scope. Decide the system, the services, the locations and the categories.
- Describe the system. Management writes the system description: services, infrastructure, people, software, data and procedures.
- Readiness check. Compare current controls to the criteria and find gaps. Fix them before the auditor starts.
- Choose Type 1 or Type 2, and for Type 2, set the period.
- Audit. The CPA firm inspects policies, configuration and evidence, interviews staff and tests samples.
- Review exceptions. The auditor reports any control that did not operate as described.
- Report. The report contains the auditor's opinion, management's assertion, the system description, the controls tested and the results.
Customers read the exceptions section as closely as the opinion.
Evidence the auditor will ask for
- Access reviews, joiner and leaver records.
- Change management tickets and approvals.
- Vulnerability scans and patching records.
- Backup and restore tests.
- Incident logs and response records.
- Vendor risk reviews.
- Security training completion.
The same evidence discipline applies to working papers in any audit. Our audit checklist generator helps turn a list like this into a checklist for a readiness review.
Common mistakes
- Treating SOC 2 as a one-off project and not as a continuing control cycle.
- Scoping too much and testing controls no customer needs.
- Writing policies that the team does not follow.
- Collecting evidence at the end of the period, not through it.
- Leaving out a key subservice provider, such as the cloud host.
Frequently Asked Questions
What is SOC 2?
A CPA's report on a service organisation's controls relating to security, availability, processing integrity, confidentiality and privacy.
Is SOC 2 a certification?
No. It is an attestation report with an opinion, not a certificate.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 looks at controls as of a date. Type 2 is generally understood to test operation over a period. Confirm the definitions in AICPA's guide.
Does a company need all five categories?
No. Security is the base. Others are added where customers need them.
Is SOC 2 required in India?
It is not a legal requirement we found. It is usually requested by customers.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error