SOC 2 report

A SOC 2 (System and Organization Controls 2) report is the report in which a US certified public accounting firm gives its opinion on a service provider's controls, measured against the Trust Services Criteria of the American Institute of Certified Public Accountants (AICPA). The criteria cover security, which is always in scope, plus any of availability, processing integrity, confidentiality and privacy. A Type I report describes the controls and judges their design at a single date. A Type II tests how they operated over a period, often six to twelve months, and lists the exceptions found. For an underwriter, only Type II shows that a control actually ran. The report is not a certification: there is no score and no pass mark, and the opinion can be qualified. It has to be read in at least four places. The period covered first, with the bridge letter that fills the gap up to the quote date. Then the exceptions. Then the complementary user entity controls, where the provider writes down what it leaves to the customer, MFA on customer accounts for instance. Last, the subservice organizations carved out of scope, often the hosting provider. The cyber market uses it in two situations. When the insured is a software-as-a-service vendor, the underwriter asks for its SOC 2 as first-rank evidence, stronger than a signed questionnaire. When the insured depends on a critical provider, the provider's report sheds light on the contingent business interruption exposure. The caveat lies in the method: the auditor samples controls the provider described itself. The software supply chain compromises at SolarWinds in 2020 and Kaseya in 2021 were a reminder that a booby-trapped update slips under that kind of control.