SOC 2 report (security, availability, processing integrity, confidentiality, privacy)
A CPA's report on how a provider's system meets chosen trust services categories (security plus any of availability, processing integrity, confidentiality, privacy); the most requested assurance report in cloud and colocation RFPs.
- 8requirementsin our own words
- 3editions SSAE No. 21 attestation standard, reports dated on or after 15 June 2022
- 0places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is voluntary in the 30 places assessed. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| All 30 places | Applies | Voluntary In force | Sector: enterprise, cloud and financial customers No law in this country requires it; customers, lenders or tenders decide. | Not stated |
What it asks for
8 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Choose the trust services categories (security plus any others) and the system boundary. | System description and category selection Policy, checked by document review | Compliance manager | Every year Governance, a system or service |
| Control and review physical access to data halls and infrastructure. | Access lists, badge logs, reviews Log, checked by document review | Security lead | Continuous Technical limit, one site |
| Control logical access, authentication and privileges. | Access reviews and provisioning tickets Log, checked by document review | Security lead | Continuous Technical limit, a system or service |
| Authorise, test and record changes. | Change tickets with approvals Record, checked by document review | IT operations | Continuous Governance, a system or service |
| Detect, escalate and resolve incidents. | Incident records and post-incident reviews Record, checked by document review | IT operations | Continuous Governance, a system or service |
| Back up, replicate and test recovery to support availability commitments. | Backup logs and recovery test results Test report, checked by document review | IT operations | Every year Governance, a system or service |
| Review vendors and subservice organisations that support the system. | Vendor register and assessments Contract, checked by document review | Procurement | Every year Governance, a system or service |
| Engage a CPA firm, choose Type 1 or Type 2 and plan the period. | Engagement letter and period schedule Contract, checked by document review | Compliance manager | Every year Contractual, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| SSAE No. 21 attestation standard, reports dated on or after 15 June 2022 | Current Applies to SOC 1, SOC 2 and SOC 3 reports; AICPA illustrative letters. | Not stated | 15 Jun 2022 | None named |
| 2017 Trust Services Criteria (with revised points of focus, 2022) | Current | 2022 | Not stated | None named |
| 2018 SOC 2 Description Criteria (with revised implementation guidance, 2022) | Current | 2018 | Not stated | None named |
Stages, levels and report types
What each one is, how long it is valid, and the claim you may make once you hold it.
| Stage or level | Report or award | Period and validity | What you may say |
|---|---|---|---|
| Type 1 | assurance report (SOC 2) | as of one datereport covers a date; no certificate | Say: SOC 2 Type 1 report as of DATE, with the trust services categories covered. |
| Type 2 | assurance report (SOC 2) | a period set by the engagement (length not fixed on the AICPA pages read)report covers a period; no certificate | Say: SOC 2 Type 2 report for the period FROM-TO. Never 'SOC 2 certified' or 'SOC 2 compliant'. |
About the programme
- Scheme owner
- AICPA & CIMA
- Assessed by
- An independent auditor
- Scope
- system or service of a service organisation
- Levels
- Type 1 and Type 2; one to five trust services categories chosen by the provider
- Validity
- A report covers a date or period; there is no certificate expiry. Buyers usually ask for a recent report (practice).
- Accreditation route
- none: licensed CPA firms
- Who asks for it
- Wholesale and hyperscale customers, Enterprise and colocation customers, Financial-sector clients
- Where it is used
- global
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.