What is an SOC 2?

A SOC 2 report is produced by an independent CPA firm after examining an organization's actual controls, not just its policies. A Type I report attests that controls are suitably designed at a single point in time; a Type II report — the one most enterprise buyers actually require — attests that those controls operated effectively over a review period, typically three to twelve months, based on sampled evidence like access logs, change tickets, and incident records. Security is the only mandatory criterion; the other four are selected based on what the organization actually promises customers. Because SOC 2 has no fixed checklist (unlike a certification with prescriptive requirements), the auditor evaluates whether the organization's own stated controls are reasonable and were actually followed — which is why continuous evidence collection (audit logs, access reviews, vendor due-diligence records) matters more than any one-time setup step.