Documentation · Security & compliance

SOC 2

An independent auditor’s report on how a service organisation protects the systems and data it runs for its customers.

Full name

System and Organization Controls 2

Issued by

A licensed CPA firm, working to AICPA attestation standards

Measured against

The AICPA Trust Services Criteria (2017, with points of focus revised in 2022)

Applies to

Service organisations, typically SaaS and cloud providers. It is not specific to medical devices

Outcome

An attestation report containing the auditor’s opinion. It is often called a certification, but no certificate is issued

In short

A SOC 2 report lets a service provider give customers independent assurance about its controls without each customer running its own audit. The criteria describe outcomes rather than prescribing specific controls: the organisation defines its own controls, and the auditor tests whether they meet the criteria.

The five categories

• Security. Required in every report, and known as the common criteria: control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation.
• Availability. The system is available for operation as committed.
• Processing integrity. Processing is complete, valid, accurate and timely.
• Confidentiality. Information designated confidential is protected.
• Privacy. Personal information is collected, used, retained and disposed of properly.

The organisation chooses which categories beyond Security are in scope, based on what it has committed to its customers.

Type 1 and Type 2

• Type 1. Whether the controls are suitably designed, at a point in time.
• Type 2. Whether they are suitably designed and operated effectively over a period, commonly three to twelve months. This is the report customers generally ask for.

On a software project

• Change management leaves evidence. Every production change has a ticket, a review, test results and an approval, with separation between the person who writes a change and the person who releases it.
• Access is managed and reviewed. Joiners and leavers are handled promptly, access is reviewed periodically, and privileges are kept to what each role needs.
• Operations are monitored. Logging and alerting, incident response, backup and recovery tests, and vulnerability management. Penetration testing is common evidence, though the criteria do not require it by name.
• Vendors are in scope. Cloud hosts and other subservice organisations are evaluated, usually through their own SOC reports.
• Controls must run all period. The auditor samples evidence from across the audit period, so a control that lapsed for a month appears in the report as an exception.

Worth knowing

• A report contains the auditor’s opinion, management’s assertion, a description of the system, and the controls with, for Type 2, the tests performed and their results.
• SOC 1 covers controls relevant to customers’ financial reporting. SOC 3 is a short public summary of a SOC 2.
• ISO/IEC 27001 is a certifiable standard for an information security management system. The two overlap, and many organisations hold both.
• In healthcare, a SOC 2 report does not replace privacy law or a device quality system, but it is useful evidence when evaluating a supplier.
• Reports are normally shared under a non-disclosure agreement and renewed every year.

Official sources

• AICPA & CIMA: SOC suite of services

A summary for orientation. It is not regulatory or legal advice, and it is no substitute for the standard or regulation itself. Requirements change: confirm the current edition before relying on anything here. Last reviewed November 2026.