SOC 2

SOC 2 is an examination, carried out by a CPA firm against the AICPA’s Trust Services Criteria. It is the report North American buyers ask for, which is why European companies selling there end up doing one.

What you are actually assessed against

Five Trust Services Categories: Security, Availability, Confidentiality, Processing Integrity and Privacy. Security — the Common Criteria — is mandatory; the other four are included only if you choose to be assessed on them.

The Common Criteria are decomposed into series: CC1 organisation and governance, CC2 communication, CC3 risk assessment, CC4 monitoring, CC5 control activities, and CC6–CC9 the technical and operational criteria. Vendorica carries them at that level, so a control cites CC6.1 rather than “access control”.

Two versions of the criteria exist, and new work uses the 2022 one

The 2017 Trust Services Criteria consolidated the earlier editions; the 2022 revision is what a new adoption gets. Both are carried, because a report covering an earlier period was issued against the earlier criteria and your records should still say so.

Type I and Type II

• Type I is design: are the controls suitably designed, as at a date.
• Type II is operation: did they actually work, across a period — usually three to twelve months.

Type II is what buyers want, and the difference matters more in Vendorica than anywhere else in the product, because a Type II is evidenced by continuity. An access review evidenced once, dated the week before the period ended, does not demonstrate an operating control; four quarterly ones do.

That is what the effective date on each piece of evidence is for. Set it to when the evidence was true, keep the expiry honest, and the register answers “was this control operating in March” without anyone reconstructing it. See Evidence.

Getting ready

1. Adopt the framework and pick your categories. Security alone is a legitimate and common scope; adding Availability or Confidentiality because it sounds better is how a first examination becomes an eighteen-month project.
2. Assign every control an owner — see Working with controls.
3. Decide the observation period before it starts, not after. Evidence cannot be created retroactively, and the gap between “we do this” and “we can show we did this in April” is the whole examination.
4. Automate what you can. Control tests fed by a connected system produce dated evidence on a schedule, which is exactly the shape a Type II wants.
5. Run the examination as an engagement — see Audits and findings. The auditor works an information-request list against your evidence library rather than an email thread.

What it is not

• Not a certificate. There is no pass mark and no logo you earn; there is a report containing an opinion, possibly with exceptions noted.
• Not a European regulatory obligation. No supervisor asks for it. It is a commercial artefact — which is exactly why it belongs on your Trust Center, where the buyer asking for it can get it under NDA without a sales call.
• Not interchangeable with ISO 27001, though the evidence overlaps heavily. If you need both, adopt both and let the crosswalk do the work.