A SOC 2 report is an independent CPA firm's report on a service organization's controls. It's based on the AICPA's Trust Services Criteria and helps customers judge how well a vendor protects their data. SOC 2 is an attestation, not a certification: the result is a report with the auditor's opinion, not a certificate.
There are two types of SOC 2 report. A Type 1 report covers whether controls are suitably designed at a point in time. A Type 2 report also tests whether those controls operated effectively over a period, typically 3 to 12 months. For more detail, see the SOC 2 Type II guide.
SOC 1, SOC 2, and SOC 3 reports serve different purposes. SOC 1 addresses controls relevant to customers’ financial reporting. SOC 2 addresses controls relevant to security, availability, processing integrity, confidentiality, or privacy within the examination’s scope. SOC 3 is a less detailed, general-use report. Organizations select the appropriate engagement for their services and stakeholders; the reports are not three mandatory stages.
Main components for SOC2 access control compliance #
SOC 2 examinations use the five Trust Services Criteria categories described in TSP section 100, the AICPA's 2017 Trust Services Criteria (with points of focus revised in 2022). Only Security is required in every SOC 2 report. The other four are included when they're relevant to the services in scope. Among those categories, ‘Security’ directly governs SOC2 access control compliance through the Common Criteria for logical and physical access (CC6). The five categories are:
- Security (required): protection against unauthorized logical and physical access.
- Privacy: personal information is collected, used, kept, disclosed, and disposed of in line with the organization's privacy notice.
- Confidentiality: information designated as confidential is protected as committed or agreed.
- Availability: the system is available for operation and use as committed or agreed.
- Processing integrity: system processing is complete, valid, accurate, timely, and authorized.
Let’s expand upon those main categories from the perspective of an organization's SOC2 physical security compliance.
Access to the system, both physical and logical, should be restricted to authorized people. That covers outsiders as well as employees and contractors who don't need access. The access procedures to the resources, assets and data should be properly designed as per rules and regulations based on the authorized access. The authorized access should be tied to individual identities rather than shared keys or codes, and events should be easily traceable.
The personal information should be properly protected both physically and logically. The collection, storage, usage, disclosure, and disposal of the personal data should follow the organization's privacy notice and the commitments it makes to the people whose data it holds.
Confidentiality should be maintained in line with the commitments and agreements the company has made with its users, clients and other stakeholders. Similarly, availability and processing integrity controls should meet the service commitments and agreements made with the users. An independent CPA firm assesses whether these controls are suitably designed and, for a Type 2 report, operating effectively over a period of time.
How physical access controls fit into SOC 2 #
Physical access falls under the Security category, which is part of every SOC 2 report. The Common Criteria require an organization to restrict physical access to its facilities and protected information assets, such as server rooms, network closets, and backup storage, to authorized personnel. They also cover granting, changing, and removing access based on each person's role, and protecting or securely disposing of hardware that holds data.
The auditor checks these controls against evidence, not just policy. Typical requests include:
- Records showing physical access was approved before it was granted, and matched the person's role
- Proof that access was removed promptly when employees and contractors left
- Periodic reviews of who can enter which doors and restricted areas
- Entry logs for sensitive areas, kept for the period under review
- Visitor records, including who hosted each guest
- Alerts for forced or held-open doors, and video where it's used
For a Type 1 report, the auditor checks that these controls are designed and in place on a given date. For a Type 2 report, the auditor tests samples across the whole period, such as a set of new hires and departures, to confirm the controls actually worked. Organizations that host in a third-party data center usually rely on the provider's own SOC 2 report for that facility, but their offices and equipment rooms remain their responsibility.
Simplify access control across every location
Centralize security management without increasing operational complexity.
When might an organization need a SOC 2 report? #
SOC 2 is not a universal legal requirement for every company collecting customer information or delivering services remotely. Customers, partners, or contracts may require a report as part of vendor assurance. The appropriate scope depends on the services provided and the needs of report users. Industries where customers commonly request SOC 2 reports include:
- Cloud Service Providers
- Data Center Hosting
- Web Hosting
- Software as a Service (SaaS)
- Managed IT and security service providers
- Finance and Healthcare services
The common thread is that these organizations store, process, or have access to their customers' data, so those customers need independent assurance about the controls around it. Enterprise buyers often ask for a SOC 2 report in security questionnaires before signing a contract.
How does an organization prepare for a SOC 2 examination? #
Preparing for a SOC 2 examination typically involves the following steps:
- Develop proper policies for information security, access control (both physical and logical), incident response, change management, and vendor management
- Implement all procedures and requirements set forth by the AICPA's Trust Services Criteria (TSP section 100) for the categories in scope
- Assess the system, controls and organizational resources with respect to above rules, often through a readiness assessment that finds gaps before the audit starts
- Create documents like management's assertion and the system description
- Make sure the system description gives a complete presentation of the people, services, subservice organizations, system boundaries, and other aspects of the organization and its controls, following the AICPA's description criteria
- Undergo an examination by an independent CPA firm and receive the SOC 2 report
The CPA firm performs the examination under the AICPA's attestation standards (AT-C sections 105 and 205). For a Type 2 report, controls must operate throughout the observation period before the auditor can test them, so organizations usually plan several months ahead.
SOC 2 readiness checklist #
- Company policies – written, approved by management, and reviewed at least once a year
- Standard operational procedures – documented steps for how controls run day to day, such as onboarding and offboarding
- Communication policies in place – so employees know their security responsibilities and how to report incidents
- Monitoring and feedback mechanism – reviews, logs, and alerts that show whether controls keep working, and a process to fix problems found
- Coordination and commitments – a clear owner for each control, and documented service commitments to customers that the controls support
For physical access, also check that:
- Door and area access is assigned by role, with approval recorded before access is granted
- Access is removed promptly when employees, contractors, or vendors leave
- Access lists are reviewed on a regular schedule, and the reviews are documented
- Entry logs for restricted areas are kept for at least the audit period
- Visitors sign in, have a named host, and receive limited or escorted access
- Alerts are in place for forced or held-open doors in sensitive areas
Final thoughts #
A SOC 2 report gives customers independent evidence that an organization protects their data, and physical access is part of every report through the Security category. Preparing well means more than writing policies. Auditors want records showing that access was approved, reviewed, and removed on time, especially for a Type 2 report.
This is where manual processes tend to fall short. Shared keys, paper sign-in sheets, and access lists kept in spreadsheets are hard to evidence. With Kisi access control, access is assigned by role, removed in one step when someone leaves, and every door event is logged in the cloud. Visitor management records who came in and who hosted them, and analytics and reporting makes it easier to export evidence for access reviews and audits.
Kisi goes through the same process itself. Kisi holds a SOC 2 report and ISO 27001 certification, and customers can request security documentation through the Kisi Trust Center