SOC 2 · THE COMPLETE GUIDE
An AICPA attestation, not a certification. Five categories, 61 criteria, and almost 300 points of focus that most teams mistake for a control checklist.
TL;DR
SOC 2 is a report in which a licensed CPA firm gives an opinion on your controls, measured against the AICPA Trust Services Criteria. It is an attestation, not a certification. No certificate exists, no registry lists you, and no body accredits you. Security is the only category you must take. The other four are yours to add when a contract asks for them.
Sources: Linford & Co · AICPA 2017 Trust Services Criteria, revised points of focus 2022
What a SOC 2 report is #
SOC stands for System and Organization Controls. The AICPA, the professional body for US certified public accountants, publishes the framework. A licensed CPA firm examines your controls against the Trust Services Criteria and writes an opinion.
That word matters. You get an opinion, not a pass mark. The report runs to dozens of pages. A reader works through the auditor’s opinion, your management assertion and a description of your system. A Type 2 adds the tests the auditor ran and what they found.
SOC 2 is not a certification #
No certificate exists. No accreditation body signs you off. No public registry lists you. Anyone who shows you a “SOC 2 certificate” has made it themselves.
This trips up teams who have done ISO 27001, where a certification body issues a certificate and an accreditation body stands behind it. SOC 2 does neither. What you hold is a report with a date range on it, and the report is the proof.
What trips people up
There is no such thing as a SOC 2 Type 3. Two things get crossed here. SOC 1, SOC 2 and SOC 3 are different reports. Type 1 and Type 2 are the two forms a SOC 1 or a SOC 2 can take. People searching for a level above Type 2, or for a version they can publish, want a SOC 3. Our guide to SOC 1, SOC 2 and SOC 3 lays the three out.
Who needs one #
A buyer decides this, not a regulator. No law requires a SOC 2 anywhere in North America. What happens instead is that your customer’s security review asks for one, and the contract names it.
So the honest trigger is commercial. You need a SOC 2 when deals stall without it. In practice that means you hold customer data and you sell to firms large enough to run a vendor risk programme. If your buyers have never asked, you may have time yet.
The criteria, and the trap inside them #
This section holds the most useful thing in this guide, and most explanations skip it.
The Trust Services Criteria sit in five categories. Across all five there are 61 criteria, and behind those criteria sit almost 300 points of focus. The security category alone carries over 200 of them.
Teams read that list of points of focus and build a control for each one. That is the single most expensive mistake in a first SOC 2, and the AICPA’s own position says not to.
“the revised points of focus themselves are not criteria but rather a range of considerations that could apply to a company’s controls.”
AAFCPAsCPA firm, on the 2022 revised points of focus
The same firm puts the practical rule in one line. You do not need a control for every point of focus in order to satisfy a criterion. You meet the criterion. How you meet it depends on your system. A point of focus with nothing to do with your system stays out of scope.
One more thing worth knowing about the 2022 revision. The categories and criteria did not change. Only the points of focus behind them changed. The revision covers newer technologies, privacy law, data retention, and the split between a data controller and a processor. If you built to the 2017 criteria, you still meet them.
What good looks like
Work criterion by criterion, not point by point. For each criterion, name the control you already run, and write down why it satisfies that criterion for your system. A short, defensible control set beats a long one you cannot evidence.
The nine common criteria #
Security, the only category you must take, breaks into CC1 through CC9.
| Series | Covers | What an auditor looks for |
|---|---|---|
| CC1 | Control environment | Board oversight, org structure, background checks, security training |
| CC2 | Information and communication | Internal policy communication, external notices, a way to report problems |
| CC3 | Risk assessment | A documented risk process, fraud consideration, change analysis |
| CC4 | Monitoring activities | Ongoing and separate evaluations, and what you do with the findings |
| CC5 | Control activities | Control selection, technology controls, policy deployment |
| CC6 | Logical and physical access | Provisioning, deprovisioning, access reviews, encryption, facilities |
| CC7 | System operations | Vulnerability detection, monitoring, incident response |
| CC8 | Change management | Authorised, tested and documented changes to infrastructure and code |
| CC9 | Risk mitigation | Business disruption planning and vendor risk management |
Series names follow Cherry Bekaert’s guide to the criteria. The “what an auditor looks for” column describes what these criteria ask about in practice rather than quoting the criteria themselves.
The four you choose #
A CPA firm puts the rule in one sentence.
“the security criteria, also known as the common criteria, is the only required category to address in a SOC 2 report.”
Cherry BekaertCPA firm, on scoping a SOC 2
- Availability. Take it when you sell an uptime commitment. If your contracts carry an SLA, a buyer will look for this one.
- Processing integrity. Take it when your system computes something the customer relies on. Payments, billing, payroll, analytics that drive decisions.
- Confidentiality. Take it when customers send you material they treat as confidential beyond personal data. Source code, deal documents, designs.
- Privacy. Take it when you handle personal information and buyers ask about it. Note that privacy here means the AICPA criteria, not PIPEDA, Quebec Law 25, HIPAA or a state privacy statute. A SOC 2 does not prove you meet any of those.
Every category you add lengthens the examination and the bill. Start with security alone unless a contract already names another, and add later rather than guessing now.
Type 1, Type 2, and what the report covers #
A Type 1 reports on control design as of a single date. A Type 2 reports on design and operation across a period. Same criteria, same auditor, different question.
The difference in scope is sample size. A Type 1 auditor inspects a control and one instance of it. A Type 2 auditor samples the population of events across the window. Our guide to the difference between Type 1 and Type 2 works through scope, period, cost and what buyers accept.
On the observation period, one correction worth carrying. The AICPA sets no minimum length. Three months is the practical floor that firms see in practice, and 12 months the common renewal cadence. Anyone telling you six months is a rule has repeated something they did not check.
What the examination runs like #
Six stages. Only one of them ignores your budget.
Scope and gap assessment #
Goal: know which categories, which systems, and what you are missing.
Pick your categories and draw the system boundary. Then measure what you run today against the criteria. Four to 12 weeks for most teams.
What goes wrong: drawing the boundary too wide. Every extra system in scope is more evidence for the rest of your life, not just this year.
Remediation #
Goal: close the gaps and write down what you do.
Build the missing controls and document the ones you already run. Policies, access reviews, onboarding and offboarding, change management, incident response, vendor review.
What goes wrong: teams build a control per point of focus. See the section above.
The observation period #
Goal: let the controls run, and keep the evidence.
Three to 12 months, agreed with your auditor before it starts. This is the stage money cannot compress. A three month window takes three months at any company size.
What goes wrong: nobody keeps the evidence as it happens. The window ends and the team reconstructs a quarter of tickets from memory.
Auditor selection #
Goal: a licensed CPA firm on your calendar.
Only a licensed CPA firm can issue the report. Good firms book six to 12 weeks out, so start this during the window rather than after it.
What goes wrong: leaving it to the end and waiting two months for a slot.
Fieldwork #
Goal: answer the auditor’s requests without stalling.
The auditor requests evidence, samples populations, interviews your people and tests the controls. Three to six weeks. Exceptions surface here.
What goes wrong: one person owns every answer and goes on holiday.
Report and distribution #
Goal: a report you can send, and a plan for next year.
Two to four weeks after fieldwork. The report goes to named recipients under an NDA, because a SOC 2 carries restricted use. A SOC 3 from the same examination is the version you may publish.
What goes wrong: treating the report as the finish. Buyers expect a new one every year, and a gap between periods reads as a lapse.
How long, and how much #
Add the stages and the arithmetic is stubborn. Add readiness, the shortest window anyone sees in practice, fieldwork and drafting. The fastest honest first Type 2 report lands at about six and a half months. With zero readiness work, about four and a half.
That is worth saying outright, because “SOC 2 in three months” appears everywhere. Three months buys one of three real things. Audit-ready status, a Type 1 report, or a three month window instead of a six or 12 month one.
On budget, the number that surprises people is how little of it goes to the auditor. Our breakdown of what a SOC 2 Type 2 report costs puts a first year total at USD 25,000 to 80,000. The audit fee is 30 to 40% of it. Internal hours, readiness, remediation and tooling carry the rest. The SOC 2 Type 2 timeline covers the calendar in the same detail.
SOC 2 across the border #
SOC 2 is an AICPA framework, and that does not make it American-only. A Canadian CPA firm can issue the report under the same standards, and CPA Canada publishes its own SOC 2 guide. A report from a Toronto firm carries the same weight with a buyer in Denver.
Two things it does not do, in either country. A SOC 2 does not prove compliance with any privacy law. PIPEDA, PHIPA, Quebec Law 25, HIPAA and the state privacy statutes each ask for things the criteria never mention. And most published SOC 2 prices are US dollars, so check the currency on a quote before you compare two of them.
Frequently asked questions #
Is SOC 2 a certification?
No. SOC 2 is an attestation. A licensed CPA firm gives an opinion on your controls and writes a report. No certificate exists, no body accredits you, and no registry lists you. The report itself is the proof, and it carries a date or a date range.
Who created SOC 2 and who can issue the report?
The AICPA publishes the framework and the Trust Services Criteria. Only a licensed CPA firm can issue a SOC 2 report. A security consultancy without CPA credentials can help you prepare, but it cannot sign the opinion.
What are the five SOC 2 Trust Services Criteria categories?
Security, availability, processing integrity, confidentiality and privacy. Security, also called the common criteria, is the only one you must take. Add the others when a contract names them or when your service makes them relevant.
Do I need a control for every point of focus?
No. The points of focus are considerations, not criteria. A CPA firm’s summary of the 2022 revision puts it directly. You do not need a control for every point of focus in order to satisfy a criterion. Meet the criterion in the way that fits your system.
Is there a SOC 2 Type 3?
No. SOC 1, SOC 2 and SOC 3 are different reports. Type 1 and Type 2 are the two forms a SOC 1 or SOC 2 takes. People looking for a level above Type 2, or for a version they can publish, want a SOC 3.
How long does a SOC 2 Type 2 take?
About six and a half months for a first report, taking the fastest realistic value at every stage. The AICPA sets no minimum observation period, three months is the practical floor, and 12 months is the common renewal cadence.
Does a SOC 2 make me compliant with privacy law?
No. The privacy category uses the AICPA criteria, which are not PIPEDA, PHIPA, Quebec Law 25, HIPAA or any state privacy statute. A clean SOC 2 says nothing about whether you meet those. Scope them separately.
Key takeaways #
- SOC 2 is an AICPA attestation from a licensed CPA firm. No certificate, no registry, no accreditation body.
- Five categories hold 61 criteria and almost 300 points of focus.
- The points of focus are considerations, not requirements. Build to the criteria, not to the list.
- The 2022 revision changed the points of focus. The categories and criteria stayed the same.
- Security is the only category you must take. Add the other four when a contract or your service calls for them.
- No SOC 2 Type 3 exists. Type 1 and Type 2 are report forms. SOC 3 is a different report.
- The AICPA sets no minimum observation period. Three months is the practical floor, not six.
- A SOC 2 proves nothing about PIPEDA, HIPAA or any state privacy statute.
Want a scoped SOC 2 rather than a long control list? #
We run the gap analysis against the criteria and agree the categories and the window with your auditor. Then we take you through the examination with a named compliance manager. Same process whether you sell in Toronto, Denver or both.
