SOC 2

What it is

An independent CPA’s report on a service organisation’s controls for security, availability, processing integrity, confidentiality and privacy.

Applies to

Service organisations — typically SaaS, cloud and data-processing providers — whose customers ask for assurance

Current version

2017 Trust Services Criteria with the 2022 revised points of focus; reports are Type 1 (a point in time) or Type 2 (a period)

Set by

AICPA (American Institute of Certified Public Accountants)

Official text: AICPA: SOC 2