Loading...
Service Organisation Controls 2 (AICPA Trust Services Criteria)
SOC 2 is an attestation framework (not a certification) based on the AICPA Trust Services Criteria. It evaluates a service organisation’s controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports are restricted-use documents produced by independent CPA firms. Security is always required; the other four criteria are optional.
5
Trust Service Categories
9
Common Criteria (CC)
Type I & II
Report Types
Voluntary
No Direct Fines
Always required. Nine Common Criteria covering control environment, communication, risk assessment, monitoring, control activities, logical/physical access, system operations, change management, and risk mitigation.
Optional. Systems are available for operation and use. Covers uptime, capacity planning, disaster recovery, and operational continuity.
Optional. System processing is complete, valid, accurate, timely, and authorised. Covers data accuracy and completeness.
Optional. Protecting confidential information by limiting access, storage, and use to authorised individuals.
Optional. Protecting personally identifiable information (PII) and compliance with AICPA Generally Accepted Privacy Principles.
Evaluate your current security controls against SOC 2 Trust Services Criteria. Identify gaps in all nine Common Criteria and any additional categories you plan to include.
Determine which Trust Service Categories to include beyond Security (mandatory). Base selection on contractual obligations, customer expectations, and industry requirements.
Design and implement controls addressing each applicable criterion. Document policies, procedures, and evidence of control operation.
Engage a CPA firm for a Type I examination to validate control design at a point in time. Address any findings before proceeding to Type II.
Conduct a Type II examination over 3-12 months to demonstrate sustained control effectiveness. This is what most enterprise customers require.
Maintain controls and evidence collection for annual SOC 2 renewals. Implement monitoring to detect control gaps between examination periods.