Information security
SOC 2 — AICPA Trust Services Criteria
The attestation report North American customers expect from software vendors and service providers.
At a glance
- Type
- Attestation framework (report, not certificate)
- Publisher
- AICPA (United States)
- Edition
- 2017 criteria, points of focus revised in 2022
- Auditor
- Independent CPA firm
61 requirements tracked · 178 shared controls
What is SOC 2?
SOC 2 is not a certification but an attestation report: an independent CPA firm examines a service organisation’s controls against the AICPA Trust Services Criteria.
A Type 1 report covers the design of controls at a given date; a Type 2 report also covers their operating effectiveness over a period, often 6 to 12 months. The Security category (common criteria CC1 to CC9) is mandatory; Availability, Confidentiality, Processing Integrity and Privacy are optional.
Key requirements
- 1
Control environment and governance (CC1–CC2)
Integrity, management oversight, structure, competence and internal and external communication.
- 2
Risk assessment and monitoring (CC3–CC5)
Risk identification, including fraud, monitoring of controls and control activities.
- 3
Logical and physical access (CC6)
Identity and access management, authentication, protection of data and premises.
- 4
System operations and change management (CC7–CC8)
Anomaly detection, incident handling and change control.
- 5
Risk mitigation (CC9)
Business continuity and management of vendors and business partners.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- SOC 2 criteria linked to 178 common controls, with a score that benefits from your ISO 27001 work
- Dated, versioned evidence with expiry reminders, to cover the period of a Type 2 report
- Access reviews, change management and incidents traced in the activity log
- Read-only access for the auditor, with no billed seat
- XLSX and PDF exports to build the file handed to the firm
Related frameworks
With ISO 27001 controls in place, your SOC 2 starting score is about 47 to 71%.
The controls you put in place for SOC 2 also count for:
Frequently asked questions about SOC 2
SOC 2 or ISO 27001: which one should we choose?
In Europe, ISO 27001 is the most requested and leads to a certificate. SOC 2 mainly answers the expectations of North American customers. Many vendors start with ISO 27001, then reuse their controls and evidence for a SOC 2 report.
Who can perform a SOC 2 audit?
Only a licensed CPA firm in the United States, or a firm that is a member of a licensed network. OK-GRC prepares the file; the report is issued by the firm.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment