SOC 2 Compliance
THE CONTROLS BEHIND THE REPORT

SOC 2 is an auditing procedure developed by the American Institute of CPAs for service organizations that hold other companies' data. The output is a report about how well your controls protect that data, measured against the AICPA'sTrust Services Criteria. It is worth being precise about what the report is. As Jeff Farr of ITS puts it: "SOC 2 is simply an attestation, an opinion rendered by a CPA." It is not a certification, and nobody issues you a certificate.

Quoted from "What is SOC 2 Compliance, and What Does It Mean for Businesses?", itsasap.com, September 2022.

Time. A Type 1 report looks at your controls on one date and asks whether their design is suitable. A Type 2 report looks at whether those same controls actually operated effectively across a full observation period. Type 2 is what most customers mean when they ask for a SOC 2, because a snapshot proves design and not habit. Type 1 is a reasonable first step if you need something to show sooner.

Type definitions as published in "What is SOC 2 Compliance, and What Does It Mean for Businesses?", itsasap.com, September 2022, quoting Jeff Farr of ITS.

No, and the two get confused constantly because they share three letters. SOC 2 is a report about how your company handles data, written by a CPA firm. A Security Operations Center is a live team of analysts watching your systems for attacks, around the clock. One is a document. The other is people on a night shift. You can hold a clean SOC 2 report and still have nobody watching at two in the morning, and plenty of companies do. ITS runs both services, separately.

Subject matter, not rigor. A SOC 1 reportcovers internal controls over financial reporting: how your services affect your customers' financial statements. A SOC 2 report covers security, availability, processing integrity, confidentiality and privacy, for a wider audience of customers, partners and regulators. They are also independent of the Type question: SOC 1 and SOC 2 both come in Type 1 and Type 2. If a prospect asked for "soc2" without saying which, it is almost always SOC 2 Type 2.

No. Only a licensed CPA firm can perform a SOC 2 examination and render the opinion, and ITS is a managed IT and cybersecurity provider, not an accounting firm. We are on the other side of the work: selecting and running the controls, keeping the evidence current, sitting in the readiness assessment, and answering the auditor's questions so your team is not doing it between meetings. You choose the auditor. We get you ready for them.

No. SOC 2 is an American attestation report written by a CPA firm about a window of time. ISO 27001 is an international certificate awarded by an accredited body for a management system. Buyers in the United States usually ask for SOC 2; buyers in Europe usually ask for ISO 27001. In practice that means certificate versus report, and an accredited certification body versus a CPA firm. If both are being asked for, the control work overlaps heavily and the evidence can be collected once. The audits cannot.