thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

SOC 2

Report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy.

Definition

SOC 2 examinations evaluate controls against the AICPA Trust Services Criteria; security (the common criteria) is mandatory and the others are optional. Reports are restricted to knowledgeable users such as customers and auditors, usually under NDA. Type 2 reports cover operating effectiveness over a period, typically 6 to 12 months.

Example

A SaaS vendor's SOC 2 Type 2 covers security and availability for January through December.

Exam tip

SOC 2 is not a certification; it is an attestation opinion by a CPA firm.

Related terms