SOC 2 Type II Compliance and Certification

SOC stands for System and Organization Controls (formerly Service Organization Control). SOC 2 is an examination in which an independent CPA firm reports on a service organization's controls, so its customers can judge how well it protects their data and their clients' privacy.

It serves to provide assurance to the organization's clients, management, and user entities in terms of confidentiality, availability, processing integrity, security, and privacy through effective control mechanisms.

SOC 2 was created by the American Institute of Certified Public Accountants (AICPA). Auditors measure controls against the AICPA's Trust Services Criteria; the current version is the 2017 Trust Services Criteria, with points of focus revised in 2022.

What is SOC 2 Type II? #

SOC 2 reports come in two types:

SOC 2 Type I #

This includes an audit and report that an auditor conducts on a specific date. It evaluates whether controls are suitably designed and implemented as of that date, but it doesn't test whether they keep working over time.

SOC 2 Type II #

This involves an audit and report that an auditor conducts over a specific period of time, typically 3 to 12 months. It tests whether controls are suitably designed and whether they operate effectively throughout that period.

SOC 2 Type II audits happen when an independent CPA firm evaluates and tests an organization's control mechanisms and activities. The goal of this is to determine if they are operating effectively.

Type II is sometimes searched for as "SOC 2 level 2," but the AICPA only uses the terms Type I and Type II.

Is there a SOC 2 Type II certification? #

No. Despite the common phrase "SOC 2 certification," there is no SOC 2 certificate. SOC 2 is an attestation: a CPA firm examines an organization's controls and issues a report with its professional opinion.

In practice, people say an organization is "SOC 2 certified" or "SOC 2 compliant" when it has a recent SOC 2 report with an unqualified (clean) opinion. When you assess a vendor, ask for the report itself rather than a badge or logo. The report shows the scope, the period covered, and any exceptions the auditor found.

This is one of the main differences between SOC 2 and ISO 27001. ISO 27001 is a certification: an accredited certification body certifies an organization's information security management system against the standard. SOC 2 is a report on specific controls over a specific period. Many organizations hold both.

What a SOC 2 Type II report includes #

A SOC 2 Type II audit report typically includes the following:

• An opinion letter from the independent service auditor
• Management's assertion about the system and its controls
• A detailed description of the system or service
• Particulars of the chosen trust services categories and the controls that address them
• Tests of controls and the results of such testing
• Other information provided by management, such as responses to exceptions. The auditor doesn't give an opinion on this section.

The opinion is the first thing most customers read. An unqualified opinion means the auditor found the controls were suitably designed and operating effectively. A qualified, adverse, or disclaimed opinion signals problems. Even a clean report can list individual exceptions, so it's worth reading the test results too.

The system description also lists complementary user entity controls (CUECs). These are controls the customer is responsible for, such as removing access for its own departing employees. A vendor's report only holds up if customers do their part.

SOC 2 reports are restricted-use, so vendors usually share them under an NDA, often through a trust center. Organizations that want a public summary can also get a SOC 3 report.

SOC 2 Type II compliance requirements #

A SOC 2 Type II report is built around five Trust Services Criteria categories. Security is required in every SOC 2 report. The other four are optional: an organization adds them based on the services it provides and what it commits to customers.

• Security. The organization's system must have controls in place to safeguard against unauthorized physical and logical access. This category is required, and its criteria are known as the Common Criteria.
• Availability. The system must be available for operation and use as committed or agreed.
• Processing integrity. The system processing must be complete, accurate, well-timed, and authorized.
• Confidentiality. The information held by the organization that is designated as confidential must be protected.
• Privacy. All personal information that the organization collects, uses, retains, and discloses must be in accordance with their privacy notice and principles. The privacy criteria are part of the AICPA's Trust Services Criteria.

SOC 2 doesn't prescribe a fixed list of controls. Each organization designs its own controls to meet the criteria, and the auditor tests whether those controls work. The AICPA's points of focus describe what auditors look for, but they're guidance, not a mandatory checklist.

The Common Criteria #

The Security category is organized into nine groups of Common Criteria. The first five follow the COSO internal control framework.

SOC 2 controls and physical access #

Physical security is part of every SOC 2 report. Under the Common Criteria (CC6), an organization must restrict physical access to its facilities and sensitive areas, such as server rooms, network closets, and storage for backups, to authorized people.

For a Type II report, the auditor tests whether these controls worked throughout the period, not just whether a policy exists, usually by checking a sample of events such as new hires and departures. For the full list of evidence auditors ask for, and a physical access checklist, see the guide to SOC 2 compliance and physical access controls.

Why do people use SOC 2 Type II? #

SOC 2 Type II reports are usually obtained by organizations that provide systems and services to client organizations such as Platform as a Service, Software as a Service, and Cloud Computing.

The client company may request an assurance audit report from the service organization. This usually happens if private or confidential information has been entrusted to the organization providing a service.

If such an organization provides cloud services, a SOC 2 Type II audit report is extremely beneficial. It helps to build trust with stakeholders and clients. Moreover, this type of audit is often a precondition for service organizations that provide services at different levels in the supply chain.

A SOC 2 Type II report comprises a detailed evaluation, by an independent CPA firm, of an organization's internal control policies and practices over a defined time frame. Typically, this could be anywhere from three months to a year. This independent review gives customers evidence of how the organization's controls perform against the AICPA's Trust Services Criteria.

No law requires SOC 2. The pressure comes from customers: enterprise buyers often ask for a SOC 2 Type II report in security questionnaires and contracts before they share data with a vendor.

Who can perform a SOC 2 audit? #

Only a licensed CPA firm can perform a SOC 2 examination and issue the report, and the firm must be independent of the organization it audits. Consultants and compliance automation tools can help an organization prepare and collect evidence, but they can't issue a SOC 2 report.

SOC 2 Type II audit process and timeline #

The SOC 2 Type II audit process usually includes these steps:

1. Running a readiness assessment to find gaps before the audit starts
2. Reviewing the audit scope, including the system, its boundaries, and the trust services categories to include
3. Creating a project plan
4. Fixing gaps, then operating controls and collecting evidence during the observation period
5. Testing controls for design and operational effectiveness
6. Validating findings and documenting any exceptions
7. Delivering and communicating the organization's report

For a first report, preparation often takes a few months, followed by an observation period of 3 to 12 months. Many organizations start with a shorter period, or with a Type I report, and move to a 12-month period in later years. Fieldwork and report writing usually add several more weeks after the period ends.

How long is a SOC 2 report valid? #

A SOC 2 report has no official expiration date, but customers usually expect one that covers a period ending within the last 12 months. That's why most organizations renew their SOC 2 Type II audit every year, with back-to-back periods.

To cover the gap between the end of the last period and today, vendors often provide a bridge letter. This is a statement from management, not the auditor, confirming that there have been no significant changes to its controls.

How to comply with SOC 2 Type II #

For organizations to pass a SOC 2 Type II audit, an independent auditor would review the controls around each component of the system:

• Infrastructure - the physical and hardware elements of a system.
• Software - the programs and operating software of a system.
• People - the personnel relevant to the operation of a system.
• Procedures - automated and manual procedures necessary for the operation of a system.
• Data - the information used and supported by a system.

When organizations enlist the services of third parties who have been granted access to some form of internal system that the client owns, there is an element of internal control risk. The type of access granted and the type of systems used will determine the level of risk that the organization faces.

When organizations with a SOC 2 Type II report want to develop software and applications, they must do so in line with the audited processes and controls. This helps ensure that organizations create, test, and release code and applications under the change management controls the auditor tested.

SOC 2 readiness checklist #

Before the observation period starts, most organizations work through a list like this:

• Define the scope: which system, which locations, and which trust services categories.
• Write or update core policies, including information security, access control, incident response, change management, and vendor management.
• Run a risk assessment and keep it up to date.
• Set up role-based access for both systems and buildings, with approvals for new access and fast removal when people leave.
• Schedule periodic access reviews and keep records of them.
• Turn on logging and monitoring for systems and restricted areas.
• Train employees on security, and track completion.
• Review the SOC 2 reports of key vendors, such as your cloud provider.
• Choose an independent CPA firm and agree on the audit period.

How Kisi supports SOC 2 #

A Type II audit covers a full period, often a year, so the hardest part of physical access compliance is keeping records consistent from month to month. Kisi access control keeps door access tied to each person’s role and records every door event in the cloud, so onboarding, offboarding, and access reviews leave a clear trail without manual logs. When the audit comes around, analytics and reporting lets you export the records auditors sample, and visitor management keeps guest records for the same period.

Create a security strategy built to scale

Discover how to evaluate risks and choose the right technologies as your business grows.