SOC 2, the report customers ask for
Understand the five trust criteria, get ready for your auditor, and keep evidence organised.
Official sources
Use these official places to read the text and find the latest version.
Official website
The AICPA publishes the trust services criteria and guidance.
Visit aicpa-cima.com (SOC suite) ↗Get the document
The trust services criteria are free to download from the AICPA website. See the AICPA page linked above.
Open the official page ↗What SOC 2 is
SOC 2 is an audit report from an independent CPA firm. It says whether your controls meet the AICPA’s trust services criteria: security, availability, processing integrity, confidentiality and privacy.
It is not a certificate. It is a report that you share with customers, usually under NDA.
How SOC 2 got to where it is today
The milestones that changed what organisations have to do.
SOC reports introduced
The AICPA introduces the SOC 1, 2 and 3 reports and the SSAE 16 standard to replace the older SAS 70.
Updated criteria
The trust services criteria are revised and aligned with other frameworks.
Revised points of focus
The AICPA revises the points of focus that guide the criteria.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You sell software or services to businesses.
Customers send security questionnaires every week.
Enterprise deals stall without a report.
You want one audit to answer many requests.
What it asks of you
The requirements fall into six areas.
Security
Protect against unauthorised access. Always in scope.
Availability
Systems are up when promised.
Processing integrity
Data processing is complete and accurate.
Confidentiality
Protect information marked confidential.
Privacy
Handle personal information as promised.
Type 1 and Type 2
Type 1 is a snapshot. Type 2 covers a period of months.
The 5 trust categories and 61 criteria
Security is always in scope, with nine common criteria groups. Availability, confidentiality, processing integrity and privacy are added only if your report covers them.
20 criteria groups · 61 criterions
Security (Common Criteria)Required in every SOC 2 report. Nine groups cover governance, risk, controls and operations.9 criteria groups · 33 criterions
CC1CC1 Control environmentLeadership sets the tone and structure for control.5 criterions
- CC1.1
The organisation shows commitment to integrity and ethical values.
What you do
- Publish a code of conduct and have staff acknowledge it yearly
- CC1.2
Leadership oversees the design and running of internal control independently of management.
What you do
- Hold regular leadership security reviews with minutes
- CC1.3
Management sets structures, reporting lines and responsibilities for control.
What you do
- Keep an org chart with named security owners
- CC1.4
The organisation attracts, develops and keeps competent people.
What you do
- Check skills at hiring and track training
- CC1.5
People are held accountable for their control responsibilities.
What you do
- Include security duties in job roles and reviews
Evidence to keep
- Code of conduct and acknowledgements
- Board or leadership minutes
- Org chart and job descriptions
CC2CC2 Communication and informationRelevant information flows inside and outside the organisation.3 criterions
- CC2.1
The organisation obtains and uses relevant, quality information to support control.
What you do
- Keep reliable logs and reports used for decisions
- CC2.2
Control responsibilities and objectives are communicated internally.
What you do
- Share policies and update staff when they change
- CC2.3
Matters affecting control are communicated to external parties.
What you do
- Publish a security contact and tell customers about relevant changes
Evidence to keep
- Policy distribution records
- Customer-facing security statements
- Incident communication templates
CC3CC3 Risk assessmentIdentify and analyse risks to your commitments.4 criterions
- CC3.1
Objectives are set clearly enough to identify risks to them.
What you do
- Write down service commitments and security goals
- CC3.2
Risks to objectives are identified and analysed.
What you do
- Run a yearly risk assessment and keep a register
- CC3.3
The potential for fraud is considered when assessing risks.
What you do
- Add fraud and misuse scenarios to the risk review
- CC3.4
Changes that could affect the control system are identified and assessed.
What you do
- Review risk when you change systems, suppliers or staff structure
Evidence to keep
- Risk register
- Risk assessment method
- Fraud risk review
CC4CC4 Monitoring activitiesCheck that controls work and fix gaps.2 criterions
- CC4.1
Ongoing or separate evaluations check that controls are present and working.
What you do
- Test key controls on a schedule
- CC4.2
Control deficiencies are evaluated and communicated to those who can fix them.
What you do
- Log findings with owners and due dates and report to leadership
Evidence to keep
- Control test results
- Internal review reports
- Remediation tracker
CC5CC5 Control activitiesControls and policies that reduce risk to acceptable levels.3 criterions
- CC5.1
Control activities that reduce risks are selected and developed.
What you do
- Map each risk to one or more controls
- CC5.2
General controls over technology are selected and developed.
What you do
- Set standards for access, change and operations of systems
- CC5.3
Controls are deployed through policies and procedures.
What you do
- Write policies and the procedures that implement them
Evidence to keep
- Policy set
- Control matrix
- IT general control documentation
CC6CC6 Logical and physical accessRestrict access to systems, data and facilities.8 criterions
- CC6.1
Logical access protections guard information assets.
What you do
- Use unique IDs, MFA and encryption for key systems
- CC6.2
Access is approved before credentials are issued and removed when no longer needed.
What you do
- Use request approvals and leaver checklists
- CC6.3
Access is granted, changed and removed based on role and least privilege.
What you do
- Review access by role each quarter
- CC6.4
Physical access to facilities and hardware is restricted.
What you do
- Use badges or locks and visitor logs
- CC6.5
Assets are disposed of or reused so that data cannot be recovered.
What you do
- Wipe or destroy devices and keep certificates
- CC6.6
Protections guard against threats from outside the system boundary.
What you do
- Use firewalls, secure remote access and web filtering
- CC6.7
Information transmission, movement and removal are restricted and protected.
What you do
- Encrypt data in transit and control removable media
- CC6.8
Controls prevent or detect and act on unauthorised or malicious software.
What you do
- Use endpoint protection and restrict software installs
Evidence to keep
- Access review records
- Joiner and leaver tickets
- MFA and encryption settings
- Physical access logs
CC7CC7 System operationsDetect, handle and recover from events.5 criterions
- CC7.1
Detection and monitoring find configuration changes and new vulnerabilities.
What you do
- Run vulnerability scans and configuration monitoring
- CC7.2
Systems are monitored for anomalies that could mean malicious acts or failures.
What you do
- Collect logs centrally and set alerts
- CC7.3
Security events are evaluated to decide whether they are incidents.
What you do
- Triage alerts using a documented severity scale
- CC7.4
Incidents are responded to with a defined programme.
What you do
- Keep an incident plan and run a yearly exercise
- CC7.5
The organisation recovers from incidents and applies what it learns.
What you do
- Complete a post-incident review for each significant incident
Evidence to keep
- Vulnerability scans
- Monitoring alerts
- Incident tickets and post-incident reviews
- Recovery test records
CC8CC8 Change managementControl changes to systems and software.1 criterion
- CC8.1
Changes to infrastructure, data, software and procedures are authorised, designed, tested and approved.
What you do
- Use pull requests, approvals and a tested rollback
Evidence to keep
- Change tickets and approvals
- Test evidence
- Release records
CC9CC9 Risk mitigationManage business disruption and supplier risk.2 criterions
- CC9.1
Risks of business disruption are identified and reduced.
What you do
- Keep continuity plans and insurance reviewed yearly
- CC9.2
Risks from vendors and business partners are assessed and managed.
What you do
- Assess critical suppliers and include security terms in contracts
Evidence to keep
- Business continuity plan
- Supplier register
- Supplier assessments and contracts
AvailabilityOptional criteria for systems that must be up and recoverable.1 criteria group · 3 criterions
A1A1 AvailabilityCapacity, protection and recovery so the service stays available.3 criterions
- A1.1
Capacity is monitored and managed to meet availability commitments.
What you do
- Track usage and plan scaling before limits hit
- A1.2
Environmental protections, backup and recovery infrastructure are in place and maintained.
What you do
- Use resilient hosting, automated backups and failover
- A1.3
Recovery plans are tested.
What you do
- Test restores and failover at least once a year
Evidence to keep
- Capacity monitoring reports
- Backup logs
- Disaster recovery test results
ConfidentialityOptional criteria for information designated confidential.1 criteria group · 2 criterions
C1C1 ConfidentialityIdentify, protect and dispose of confidential information.2 criterions
- C1.1
Confidential information is identified and protected for its stated life.
What you do
- Label confidential data and restrict access and sharing
- C1.2
Confidential information is disposed of when no longer needed.
What you do
- Delete data at the end of retention and at contract end
Evidence to keep
- Data classification scheme
- Retention schedule
- Deletion records
Processing integrityOptional criteria for systems whose processing must be correct and complete.1 criteria group · 5 criterions
PI1PI1 Processing integrityProcessing is complete, valid, accurate, timely and authorised.5 criterions
- PI1.1
Information about processing definitions and data specifications is obtained and used.
What you do
- Document what the system should do and what data it needs
- PI1.2
Inputs are complete, accurate and valid.
What you do
- Validate inputs and reject bad data
- PI1.3
Processing policies and procedures keep processing complete, accurate and timely.
What you do
- Use reconciliations and error queues
- PI1.4
Outputs are complete, accurate and delivered to the right recipients.
What you do
- Check outputs and control distribution
- PI1.5
Stored inputs and outputs are kept complete and accurate.
What you do
- Protect stored data and track changes
Evidence to keep
- Processing specifications
- Input and output reconciliations
- Error handling logs
PrivacyOptional criteria for personal information, covering eight areas.8 criteria groups · 18 criterions
P1P1 NoticeTell people what happens to their personal information.1 criterion
- P1.1
A privacy notice is provided to data subjects covering purposes, use, retention and disclosure.
What you do
- Publish and date a plain privacy notice
Evidence to keep
- Privacy notice
- Notice version history
P2P2 Choice and consentRespect people's choices.1 criterion
- P2.1
Choices are explained and consent is obtained where required.
What you do
- Record consent and offer a way to withdraw
Evidence to keep
- Consent records
- Preference settings
P3P3 CollectionCollect only what is needed.2 criterions
- P3.1
Personal information is collected consistent with stated objectives.
What you do
- Collect only fields you need
- P3.2
Explicit consent is obtained for sensitive personal information.
What you do
- Ask separately and record the consent
Evidence to keep
- Data collection inventory
- Sensitive data consent records
P4P4 Use, retention and disposalUse data as promised and delete it on time.3 criterions
- P4.1
Personal information is used only for stated purposes.
What you do
- Block unrelated reuse of personal data
- P4.2
Personal information is kept only as long as needed.
What you do
- Set retention periods and automate deletion
- P4.3
Personal information is securely disposed of.
What you do
- Delete and keep evidence of deletion
Evidence to keep
- Retention schedule
- Disposal records
P5P5 AccessLet people see and correct their information.2 criterions
- P5.1
Individuals can access their personal information.
What you do
- Run a documented process for access requests
- P5.2
Individuals can correct and update inaccurate information.
What you do
- Let people request corrections and record the outcome
Evidence to keep
- Access request log
- Correction records
P6P6 Disclosure and notificationShare data only as agreed and tell people about breaches.7 criterions
- P6.1
Personal information is disclosed to third parties only with consent or notice.
What you do
- Check consent before sharing
- P6.2
Authorised disclosures are recorded.
What you do
- Keep a log of disclosures
- P6.3
Unauthorised disclosures are recorded.
What you do
- Log all unauthorised disclosures and their handling
- P6.4
Third parties handling personal information are bound by agreements.
What you do
- Include privacy terms in contracts
- P6.5
Third parties notify the organisation of breaches and incidents.
What you do
- Require prompt breach notice from suppliers
- P6.6
Affected parties are notified of breaches.
What you do
- Prepare notification templates and thresholds
- P6.7
Individuals can receive an account of personal information held and disclosed.
What you do
- Be able to report what you hold and who received it
Evidence to keep
- Disclosure records
- Supplier agreements
- Breach notification records
P7P7 QualityKeep personal information accurate.1 criterion
- P7.1
Personal information collected and used is accurate, complete and relevant.
What you do
- Validate data and offer ways to update it
Evidence to keep
- Data quality checks
P8P8 Monitoring and enforcementHandle complaints and check compliance.1 criterion
- P8.1
Privacy inquiries, complaints and disputes are handled and compliance is monitored.
What you do
- Track complaints to resolution and review privacy controls yearly
Evidence to keep
- Complaints log
- Privacy compliance reviews
Nothing matches. Clear the search or pick another trust category.
Outcomes and implementation examples are from AICPA 2017 Trust Services Criteria, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Choose criteria and period
Security plus any others.
- 2
Run a readiness check
Find gaps before the auditor does.
- 3
Fix and document
Policies, access reviews, change records.
- 4
Collect evidence
Continuously for Type 2.
- 5
Audit and share
Receive the report and share under NDA.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Security | Controls library with evidence |
| Availability | Uptime and recovery tests |
| Processing integrity | Process checks and logs |
| Confidentiality | Data classification records |
| Privacy | Notice and request records |
| Type 1 and Type 2 | Evidence collected across the period |
Free SOC 2 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Readiness checklist
- Access review template
- Vendor review form
- Incident response plan (sample)
Share or cite this page
Writing about SOC 2? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/soc-2/">SOC 2 explained in plain English - Optimus CyberX</a>Common questions
Is SOC 2 mandatory?
No. It is not required by law. Customers, especially larger ones, ask for a SOC 2 report before buying.
Type 1 or Type 2?
Many start with Type 1, then move to Type 2 for a period of months.
Is it a certification?
No. It is a report written by an independent CPA firm. There is no certificate, only the auditor’s opinion.
How long is it valid?
Customers usually expect a new report every year.
Related frameworks
See how ready you are for SOC 2
Answer questions across every area. We email you a report showing where you comply and where you do not.