01
Service Organization
An organization that provides services or functions to user entities through people, technology and processes.
01 / THE FOUNDATION
What is SOC 2?
SOC 2 is a service-organization examination focused on controls relevant to security, availability, processing integrity, confidentiality and/or privacy. It helps report users assess and address risks arising from their relationship with a service organization.
SOC 2SYSTEM & ORGANIZATION CONTROLS
An examination of a system, controls and management assertion.
The organization defines the system and its boundaries, describes relevant services and controls, identifies applicable Trust Services Criteria, and management makes an assertion. The independent service auditor then obtains evidence and forms an opinion under the applicable attestation standards.
01System
02Scope
03Controls
04Assertion
05Evidence
06Opinion
02
System
Infrastructure, software, people, procedures and data used to achieve business objectives.
03
Controls
Policies and procedures within the system of internal control designed to provide reasonable assurance that commitments and requirements are achieved.
04
Report Users
Specified parties use the report to understand the system and assess risks associated with the service organization.
02 / TYPE 2 EXPLAINED
What is SOC 2 Type 2?
Type 2 addresses the system description and suitability of control design, and adds whether the controls operated effectively throughout a specified period. It also includes a detailed description of the service auditor's tests of controls and their results.
POINT IN TIME
SOC 2 Type 1
Examines whether the system was designed and implemented as of a point in time and whether relevant controls were suitably designed as of that point.
VS
SPECIFIED PERIOD
SOC 2 Type 2
Also examines the description and control design, but additionally tests whether controls operated effectively throughout the specified examination period.
Key distinction: Type 1 answers “what was designed and in place at a point in time?” Type 2 goes further: “did the relevant controls operate effectively throughout the specified period?”
Related reading:Learn about the point-in-time examination on ourSOC 2 Type 1 compliance audit page ↗, or download the public summary from ourSOC 3 audit services page ↗. For financial-reporting controls, seeSOC 1 audit report services ↗.
03 / WHY TYPE 2
Why do organizations pursue SOC 2 Type 2?
SOC 2 is commonly requested when customers, business partners or other specified report users need information about the design, operation and effectiveness of controls at a service organization.
01
Enterprise Trust
Provide customers with independent assurance about controls relevant to the services they rely on.
02
Procurement Readiness
Support security due diligence and vendor-risk conversations with a structured assurance report.
03
Operational Discipline
Make controls repeatable, owned, monitored and supported by evidence rather than documentation alone.
04
Risk Visibility
Help report users understand the system, commitments, requirements and controls relevant to their relationship with you.
04 / TRUST SERVICES CRITERIA
What are Trust Services Criteria?
Trust Services Criteria are the criteria used to evaluate the suitability of control design and, in Type 2, operating effectiveness for the Trust Services category or categories within scope.
Security
Information and systems are protected against unauthorized access, unauthorized disclosure and damage that could affect the ability to meet objectives.
COMMON CRITERIA / CCAvailability
Information and systems are available for operation and use to meet the entity's objectives.
COMMON + A SERIESProcessing Integrity
System processing is complete, valid, accurate, timely and authorized to meet the entity's objectives.
COMMON + PI SERIESConfidentiality
Information designated as confidential is protected to meet the entity's objectives.
COMMON + C SERIESPrivacy
Personal information is collected, used, retained, disclosed and disposed of to meet the entity's objectives.
COMMON + P SERIES✓ Is Security required?
In practice, yes. Security is expressed through the common criteria (CC1–CC9) and is the baseline for nearly every SOC 2 examination. Availability, Processing Integrity, Confidentiality and Privacy are optional add-on categories. You do not need all five; you need Security plus any category that matches your commitments and report-user needs.
⚠ Choosing scope matters
The right TSC scope should reflect your services, commitments, system requirements, risks, customer expectations and the information your report users need. More categories mean broader control scope and evidence requirements.
05 / THE TSC ARCHITECTURE
How the Common Criteria (CC1–CC9) fit together
Security is evaluated through nine common-criteria series. CC1–CC5 align to the COSO internal-control components. CC6–CC9 are supplemental common criteria for access, operations, change management and risk mitigation. These nine series apply in a Security-scoped SOC 2 examination.
CC1Environment
CC2Information
CC3Risk
CC4Monitoring
CC5Activities
CC6Access
CC7Operations
CC8Change
CC9Mitigation
CC1
Control Environment
Integrity, ethics, board oversight, structure, competence and accountability.
CC2
Communication & Information
Relevant quality information and internal/external communication needed for control operation.
CC3
Risk Assessment
Identification and assessment of risks that could prevent commitments and objectives from being achieved.
CC4
Monitoring Activities
Ongoing and separate evaluations plus timely communication and remediation of deficiencies.
CC5
Control Activities
Control activities selected and developed to mitigate risks, including technology general controls deployed through policies and procedures.
CC6
Logical & Physical Access
Identification, authentication, authorization, encryption, boundary protection and physical access to systems and facilities.
CC7
System Operations
Detection and response to threats, monitoring, vulnerability handling, incident management and system operation events.
CC8
Change Management
Authorization, design, testing and approval of infrastructure, data, software and procedure changes before release.
CC9
Risk Mitigation
Vendor and business-disruption risk mitigation, including complementary vendor controls and recovery considerations.
Accuracy note: Do not collapse CC6–CC9 into CC5. They are separate common-criteria series in the current Trust Services Criteria (2017 TSC, 2022 points of focus).
06 / COSO CONNECTION
What is a COSO Principle?
COSO is the Committee of Sponsoring Organizations of the Treadway Commission. The 2017 Trust Services Criteria were structured and aligned with the COSO 2013 Internal Control—Integrated Framework and its 17 principles.
COSO • 5 COMPONENTS • 17 PRINCIPLES
Internal control, translated into SOC 2 criteria.
COSO principles describe fundamental elements that must be present or functioning for internal control to be considered effective. SOC 2 maps the common criteria to this structure.
Practical meaning: COSO gives the internal-control architecture; TSC applies that architecture to service-organization assurance.
01 • CONTROL ENVIRONMENTIntegrity and ethical values.
02 • CONTROL ENVIRONMENTBoard exercises oversight responsibility.
03 • CONTROL ENVIRONMENTStructures, reporting lines, authority and responsibility.
04 • CONTROL ENVIRONMENTAttracts, develops and retains competent individuals.
05 • CONTROL ENVIRONMENTHolds individuals accountable for internal-control responsibilities.
06 • RISK ASSESSMENTSpecifies suitable objectives.
07 • RISK ASSESSMENTIdentifies and analyzes risks.
08 • RISK ASSESSMENTAssesses fraud risk.
09 • RISK ASSESSMENTIdentifies and assesses significant change.
10 • CONTROL ACTIVITIESSelects and develops control activities to mitigate risks.
11 • CONTROL ACTIVITIESSelects and develops general control activities over technology.
12 • CONTROL ACTIVITIESDeploys control activities through policies and procedures.
13 • INFORMATIONObtains or generates relevant, quality information.
14 • INFORMATIONCommunicates internal-control information internally.
15 • INFORMATIONCommunicates relevant matters externally.
16 • MONITORINGSelects, develops and performs ongoing/separate evaluations.
17 • MONITORINGEvaluates and communicates control deficiencies in a timely manner.
Authoritative sources
07 / OBSERVATION PERIOD
How long is a SOC 2 Type 2 observation period?
The AICPA guide says a Type 2 examination is performed for a specified period of time and that management determines the time frame. It does not prescribe a universal 3-, 6-, 9- or 12-month observation period.
SHORTER PERIOD
3 Months
Can be commercially useful when a customer or engagement requirement accepts a shorter period. Less historical operating evidence is covered than with a longer period.
BALANCED
6 Months
A common planning option for organizations seeking a broader operating window while keeping the evidence history manageable.
EXTENDED
9 Months
Provides a longer operating history and more evidence across recurring controls and changing conditions.
LONGER ASSURANCE WINDOW
12 Months
Provides the broadest of these four periods and can demonstrate control operation across a full annual cycle where appropriate.
Important: These four durations are planning options, not AICPA validity rules or mandatory Type 2 periods. The appropriate period should be determined from engagement scope, customer expectations, control maturity, business cycles and the requirements agreed with the service auditor.
07B / COST & TIMELINE
How long does SOC 2 Type 2 take, and what drives cost?
There is no single AICPA price or calendar. Elapsed time is mostly the observation window plus readiness. Cost depends on scope, maturity, TSC categories, evidence quality and the service auditor's engagement model.
01
Readiness
Often 4–12 weeks: scope, gap assessment, policies, control owners, tooling and an evidence workflow. Immature environments take longer.
02
Observation period
Management and the service auditor agree a specified period — commonly 3, 6, 9 or 12 months. Controls must operate and produce evidence throughout that window.
03
Examination & report
After (or late in) the window, the service auditor tests evidence, evaluates deviations and issues the Type 2 report. This phase is often several weeks, not several days.
What usually drives cost
- Number of TSC categories beyond Security
- System breadth: products, entities, locations, cloud accounts
- Control maturity and evidence quality at kickoff
- Inclusive vs carve-out treatment of subservice organizations
- Service-auditor fees, readiness advisory fees and any tooling
How CyberAtrix prices work
CyberAtrix scopes readiness and implementation separately from the independent CPA examination. Ask for a written scope and fee for your system — published "starting from" figures on social channels are not a substitute for a scoped proposal.
Market ranges published by other readiness platforms often span several thousand to tens of thousands of dollars for smaller companies, before auditor fees. Treat those as planning context, not a quote.
Independence: CyberAtrix can prepare the control environment, evidence and stakeholders. The SOC 2 Type 2 report and opinion are issued by an independent licensed service auditor.
08 / SOC 2 TYPE 2 IMPLEMENTATION
From Gap → Control → Evidence → Audit
A practical implementation program should prepare the organization to operate the controls consistently — not merely document them.
01
Scope02
Gap Assessment03
Risk & Control Design04
Policies05
Implementation06
Operate07
Evidence08
Readiness09
CPA Examination01
Scope & System
Define the service, system boundaries, components, commitments, requirements, applicable TSC categories and relevant stakeholders.
02
Control Implementation
Design and implement policies, processes and technical controls with owners, frequencies, evidence requirements and exception handling.
03
Operating Period
Operate the controls consistently, collect evidence, monitor deviations, remediate issues and maintain the system description as needed.
09 / TYPE 2 EVIDENCE
What does the auditor actually test?
In Type 2, the service auditor designs and performs procedures to obtain sufficient appropriate evidence about operating effectiveness and describes the tests and results in the report.
Typical control evidence
Access reviews
User onboarding/offboarding
Vulnerability management
Patch evidence
Change approvals
Incident records
Backup evidence
Monitoring records
Risk assessments
Vendor reviews
Security training
Management reviews
Type 2 testing concepts
Inquiry
Inspection
Observation
Reperformance
Sampling
Timing of tests
Extent of tests
Reliability of information
Deviation evaluation
Materiality
Remediation response
Written representations
10 / WHO DOES WHAT?
Management, CyberAtrix & the CPA
SOC 2 is not simply a consultant-issued certificate. Management owns the system and assertion; the independent service auditor performs the attestation examination and issues the report.
M
Management
Defines scope, prepares the system description and written assertion, operates the system and controls, provides evidence and representations, and remains responsible for the underlying system and controls.
C
CyberAtrix
Supports readiness and implementation: gap assessment, risk/control mapping, policies, control implementation, evidence workflows, remediation and audit preparation.
A
Service Auditor / CPA
Performs the independent examination under the applicable attestation standards, obtains evidence, evaluates the description and controls, performs tests for Type 2 and issues the service auditor's report.
11 / CPA & ATTESTATION
What is a CPA? What is CPA attestation?
CPA — Certified Public Accountant
A CPA is a professional accountant licensed under applicable jurisdictional requirements. In a SOC 2 examination, the AICPA standards refer to the practitioner; this guide uses the term service auditor for the practitioner performing the SOC 2 examination.
- Must meet applicable professional and ethical requirements.
- The engagement team must have appropriate competence and capabilities.
- Independence and professional judgment are central to an examination engagement.
What is CPA attestation?
An attestation engagement is based on an assertion by a responsible party about whether subject matter is measured or evaluated against suitable criteria. In SOC 2, management is the responsible party and provides a written assertion; the service auditor obtains sufficient appropriate evidence and expresses an opinion.
- Applicable U.S. SOC 2 examinations use the AICPA attestation standards, including AT-C 105 and AT-C 205.
- Type 2 adds operating-effectiveness testing and a description of tests and results.
- The SOC 2 report is restricted to specified parties who have sufficient knowledge to understand it.
12 / WHAT IS IN THE REPORT?
The SOC 2 Type 2 report structure
The AICPA guide identifies three key components in the SOC 2 report, with Type 2 adding operating-effectiveness subject matter and detailed tests/results.
01
System Description
Management's description of the system throughout the examination period, prepared using the applicable description criteria.
02
Management Assertion
Management's assertion addresses the description, suitability of control design and, for Type 2, operating effectiveness throughout the period.
03
Service Auditor Report
The auditor's opinion plus the Type 2 description of tests of controls and the results of those tests.
Report use: SOC 2 reports are intended for specified parties with sufficient knowledge and understanding of the service organization, its services, system, controls, criteria and related risks.
13 / IMPORTANT SOC 2 CONCEPTS
Other areas that can affect your Type 2
01
System Boundaries
Clearly define what is inside the examination and how system components support the services in scope.
02
Complementary User Entity Controls
Some controls assumed in the design may need to be performed by the customer/user entity; these responsibilities matter to report users.
03
Subservice Organizations
Vendors may perform functions that form part of the service organization's system. Inclusive and carve-out approaches can affect the examination.
04
System Changes
Changes during the Type 2 period can affect testing, control populations, descriptions and evaluation of operating effectiveness.
14 / BUSINESS VALUE
How does a SOC 2 Type 2 report help your organization?
A Type 2 report gives specified report users independent information about the system, relevant controls and whether those controls operated effectively throughout the examination period. That evidence can strengthen customer trust, support procurement conversations and reduce the need to explain your control environment from scratch.
TYPE
2
2
FROM DOCUMENTATION → TO EVIDENCE
Turn your control environment into a credible assurance story.
Instead of relying only on policies, questionnaires or point-in-time claims, your organization can provide a formal independent report covering the defined system, applicable criteria, control design and operating effectiveness for the specified period.
Win and retain enterprise customers
Give customers and partners structured assurance about controls relevant to the services they depend on.
Demonstrate operating effectiveness
Show that relevant controls were not merely designed, but operated throughout the defined examination period.
Reduce security-review friction
Use an independent assurance report as a stronger response to customer security reviews and vendor-risk requests.
Strengthen internal discipline
Establish clearer ownership, repeatable evidence collection, monitoring and remediation around your control environment.
01Independent examination
02Specified-period evidence
03Control test results
04Management assertion
05Service auditor opinion
06Customer-ready assurance
Most first-time Type 2 programs stall on owners, frequencies and evidence — not on writing one more policy.
Common gapControl operation vs documentation
An evidence matrix with a named owner for each recurring control is usually what makes the examination window survivable.
Examination prepSampling, tickets, reviews, exceptions
Over-scoping Availability, Privacy or extra products is a frequent way to inflate cost without helping report users.
Scope disciplineMatch TSC categories to commitments
The cards above summarize recurring engagement patterns, not attributed customer quotations.
15 / WHO SHOULD PURSUE IT?
Who should get a SOC 2 Type 2 report?
SOC 2 is not an ISO-style certification. It is an attestation examination and report. Organizations should consider pursuing Type 2 when their customers, partners, contracts, procurement teams or risk profile require credible evidence about controls operating over time.
01
SaaS & Cloud Providers
Especially organizations hosting, processing or managing customer information through cloud-based products and platforms.
HIGH FIT
02
Technology & Managed Services
MSPs, IT service providers, infrastructure providers and technology partners whose customers depend on their controls.
HIGH FIT
03
Data & Business Process Services
Organizations handling customer data, operational processes or other services where control assurance affects third-party risk.
STRONG FIT
04
Enterprise Vendors
Suppliers entering larger procurement programs where security and control assurance is a recurring commercial requirement.
STRONG FIT
05
Fintech & Digital Platforms
Platforms with heightened expectations around security, availability, processing integrity, confidentiality or privacy.
SCOPE DEPENDENT
06
Growth-Stage Companies
Companies preparing for enterprise expansion, strategic partnerships or customer due diligence that need a repeatable assurance program.
GROWTH READY
Good fit ≠ mandatory.The decision should be based on customer requirements, contractual expectations, risk, service commitments, system scope and the value the report provides to intended users.
16 / CYBERATRIX ADVANTAGE
How CyberAtrix will help you achieve your SOC 2 Type 2 report
CyberAtrix helps you move from readiness to an evidence-backed operating control environment — while keeping scope, ownership, remediation and audit preparation aligned.
01AssessScope • Gap • Risk
→02DesignTSC • Controls • Policies
→03ImplementOwners • Processes • Tools
→04OperateEvidence • Monitoring • Remediation
→05PrepareAudit Readiness • CPA Support
Performance-first execution
Focused workstreams, practical prioritization and evidence-driven execution designed to keep the engagement moving.
Security + GRC expertise
Translate technical security, governance and operational practices into controls, evidence and an examination-ready environment.
Delivery discipline
Clear ownership, milestones, remediation tracking and structured evidence workflows so teams know what needs to happen next.
Competitive, value-focused costing
Right-size the scope, avoid unnecessary control overhead and build a practical roadmap aligned to your business and budget.
Editorial policy: CyberAtrix assurance content is written by practitioners with hands-on SOC 2 and ISO 27001 engagement experience, reviewed for technical accuracy, and updated when AICPA guidance, Trust Services Criteria or professional standards change.Read our editorial policy ↗
18 / EXECUTIVE OVERVIEW
SOC 2 Type 2 — the complete picture.
A detailed guide for founders, CTOs, CISOs, compliance teams and security leaders evaluating, preparing for or maintaining a SOC 2 Type 2 examination.
SOC 2 Type 2 is an examination of a service organization's system, the suitability of control design and the operating effectiveness of relevant controls over a specified period. The report is built around management's description and assertion and an independent service auditor's report. In Type 2, the auditor also describes the tests performed and the results of those tests.
Search phrases such as SOC 2 Type II usually mean the same examination. The accurate framing is an attestation report, not an ISO-style certification.
Plain-English definition: Type 1 asks whether controls are suitably designed at a point in time. Type 2 goes further by examining whether the relevant controls actually operated effectively throughout the defined examination period.
19 / SCOPE & SYSTEM DESCRIPTION
Start with the system, not the checklist.
A successful SOC 2 Type 2 program begins by accurately defining the service, system boundaries, commitments, risks, people, processes and technology that support the service.
What belongs in scope?
The description should explain the system used to provide the service and the controls relevant to the applicable Trust Services Criteria. Depending on the service, this can involve infrastructure, applications, databases, networks, endpoints, people, processes, facilities and supporting vendors.
Typical scoping questions
- Which products or services are being examined?
- Which legal entities, locations and business functions support them?
- Which environments, applications, cloud services and data stores are relevant?
- Which people and processes have responsibilities for the in-scope system?
- Which commitments and system requirements drive the control objectives?
Why the description matters
The system description is not simply marketing copy. It forms a core part of the SOC 2 report and gives report users context for understanding the service, system, controls, risks and applicable criteria.
A useful description connects
- Services and service commitments
- Infrastructure and technology components
- People and organizational roles
- Processes and operational activities
- Data flows and information assets
- Relevant controls and Trust Services Criteria
Common scoping mistakes to avoid
Over-broad scopeIncluding systems and functions that do not materially support the service can create unnecessary control and evidence overhead.
Under-scoped dependenciesIgnoring critical cloud, vendor, support or operational dependencies can leave important parts of the service environment unexplained.
Unclear ownershipControls without named owners often become difficult to operate consistently and difficult to evidence during testing.
Weak data-flow mappingCustomer information should be traceable through relevant collection, processing, storage, transmission and disposal activities.
Missing commitmentsThe scope should connect customer and contractual commitments with the system requirements and controls designed to address them.
Static scope assumptionsType 2 covers a period. Significant system, vendor or process changes during the period need to be considered.
20 / SOC 2 TYPE 2 READINESS
What should be ready before the examination?
Readiness is about more than writing policies. The objective is a control environment that is implemented, owned, operating and capable of producing defensible evidence.
Governance & accountability
- Defined scope and service commitments
- Named control owners and approvers
- Information security governance
- Risk assessment and treatment process
- Management oversight and review
- Policy approval and review lifecycle
People & workforce controls
- Joiner, mover and leaver processes
- Background screening where applicable
- Security awareness and training
- Confidentiality obligations
- Role-based responsibilities
- Periodic access reviews
Technology & infrastructure
- Asset and system inventory
- Identity and access management
- Privileged access controls
- Vulnerability and patch management
- Endpoint and network security
- Logging and monitoring
Software development & change
- Secure development practices
- Code review
- Change approval
- Testing before production deployment
- Emergency change handling
- Release and deployment evidence
Availability & continuity
- Backup and restore processes
- Business continuity planning
- Disaster recovery arrangements
- Capacity monitoring
- Availability monitoring
- Recovery testing
Vendor & subservice management
- Vendor inventory and classification
- Security due diligence
- Contractual security requirements
- Periodic vendor review
- Subservice organization analysis
- CUEC / CSOC considerations
21 / EVIDENCE ENGINE
Build evidence that proves the control operated.
For Type 2, evidence should support the auditor's procedures over the examination period. A policy alone usually does not demonstrate that a recurring operational control was performed.
| Control area | Example control activity | Possible evidence | What the evidence should demonstrate |
|---|---|---|---|
| Access Management | Periodic review of user and privileged access | Review report, approval record, remediation tickets | The review occurred, responsible personnel performed it, exceptions were evaluated and changes were completed. |
| Joiner / Leaver | Access is provisioned or removed based on authorized events | HR ticket, access ticket, system logs, approval | The process operated for sampled employees/events. |
| Vulnerability Management | Periodic scanning and remediation | Scan reports, tickets, remediation evidence | Scanning occurred and identified issues were tracked according to defined requirements. |
| Change Management | Production changes require approval and testing | Change tickets, pull requests, approvals, deployment records | Sampled changes followed the defined process. |
| Incident Response | Security incidents are identified, handled and reviewed | Incident records, timelines, post-incident review | The response process operated and relevant events were documented. |
| Backup & Recovery | Backups run and recovery is periodically tested | Backup logs, alerts, restore-test evidence | Backup and recovery controls operated and exceptions were addressed. |
| Vendor Management | Security assessment before onboarding and periodic review | Questionnaire, assessment, contract, review record | Third-party risks were assessed and required actions were followed. |
| Security Awareness | Personnel complete required security training | Training platform reports, completion records | Training occurred for the applicable population during the period. |
Evidence principle: the exact evidence population, sampling, timing and testing procedures are determined in the examination context. CyberAtrix can help organize an evidence matrix, ownership model and collection workflow; the independent service auditor determines the examination procedures.
22 / WHAT DOES THE AUDITOR TEST?
Type 2 testing is more than checking documents.
The attached AICPA material describes procedures used to obtain sufficient appropriate evidence. Depending on the control and engagement, testing can involve inquiry, inspection, observation and reperformance, with consideration of sampling, timing, extent, reliability and deviations.
INQUIRY
Ask the control owner
The auditor may ask responsible personnel how a control is performed, when it occurs, what exceptions look like and how the activity is evidenced.
INSPECTION
Inspect evidence
The auditor may inspect records, approvals, configurations, tickets, reports or other evidence supporting the operation of the control.
OBSERVATION
Observe execution
For relevant activities, the auditor may observe how a control is performed to evaluate whether the described process matches actual practice.
REPERFORMANCE
Reperform the control
Where appropriate, the auditor may independently perform or recreate a control procedure to evaluate the result.
Sampling & population
Recurring controls create populations of control activities or transactions. The auditor considers the nature of the control, frequency, period, evidence reliability and other engagement factors when determining testing procedures.
Deviations & exceptions
A missed control activity or exception is not automatically equivalent to a failed report. The service auditor evaluates deviations in the context of the control, testing, materiality, operating effectiveness and the evidence supporting the overall opinion.
23 / CUECs & CSOCs
Controls that sit outside your four walls.
SOC 2 environments often depend on controls performed by customers or subservice organizations. Those dependencies can affect the system description and how report users interpret the examination.
Complementary User Entity Controls
A CUEC is a control expected to be implemented by the user entity when the service organization's controls cannot provide reasonable assurance on their own. The SOC 2 report can identify these assumed controls so report users understand their responsibilities.
Examples
- Customer manages its own user access appropriately
- Customer configures a service according to documented requirements
- Customer reviews relevant outputs or reports
Complementary Subservice Organization Controls
When controls at a subservice organization are necessary, in combination with the service organization's controls, to achieve service commitments and system requirements, those controls can be identified as complementary subservice organization controls.
Why it matters
Cloud, hosting, payment, identity, data processing and other critical service providers can become important dependencies in the control environment.
24 / SUBSERVICE ORGANIZATIONS
Inclusive vs carve-out.
The attached AICPA guide describes two approaches for addressing subservice organizations in the SOC 2 system description.
| Inclusive method | Carve-out method | |
|---|---|---|
| System description | Includes relevant components and controls of the subservice organization. | Excludes the subservice organization's components from the scope, while describing the services and relevant complementary controls. |
| Auditor examination | Controls at the included subservice organization are subject to the service auditor's examination procedures. | The service auditor does not examine the carved-out subservice organization's controls within the service organization's examination. |
| When it may help | Useful when the subservice function is extensive and users need more direct information about those controls. | Often practical when a suitable subservice SOC report exists or inclusion is not feasible. |
| Management consideration | Requires appropriate coordination and responsibilities across the service organization, subservice organization and auditor. | Requires clear disclosure of the subservice organization's role and the types of complementary controls expected there. |
25 / SOC 2 VS OTHER ASSURANCE
SOC 2 Type 2 vs ISO 27001, SOC 1 and SOC 3.
These frameworks and reports serve different purposes. The comparison below is intended to clarify terminology, not to suggest that one assurance mechanism universally replaces another.
| Topic | SOC 2 Type 2 | ISO/IEC 27001 | SOC 1 | SOC 3 |
|---|---|---|---|---|
| Nature | Attestation examination and report | Management-system standard with certification when independently certified | Attestation report focused on controls relevant to user entities' financial reporting | General-use SOC report based on relevant Trust Services Criteria |
| Primary lens | Controls relevant to selected Trust Services Criteria | Information security management system | Controls relevant to financial reporting at user entities | Trust Services Criteria for general users |
| Type 2 concept | Operating effectiveness over a specified period | Certification audit assesses conformity to the standard | Type 2 also examines operating effectiveness over a period | Designed as a general-use report; reporting structure differs from SOC 2 |
| Typical audience | Specified report users | Customers, partners, regulators and other stakeholders depending on certification and context | Auditors and users concerned with financial reporting controls | General users who need a Trust Services report |
| Learn more | This page | ISO/IEC 27001 ISMS ↗ | SOC 1 audit report services ↗ | SOC 3 audit services ↗ |
26 / CYBERATRIX DELIVERY MODEL
How CyberAtrix can take you from gap to examination readiness.
A practical delivery model keeps the program tied to your service, risks and actual operating environment rather than producing documentation in isolation.
PHASE 01
Discovery
Understand services, architecture, data, people, vendors and customer commitments.
PHASE 02
Scoping
Define system boundaries, criteria, entities, locations, dependencies and report objectives.
PHASE 03
Gap Assessment
Compare current practices and evidence against applicable control expectations.
PHASE 04
Risk & Controls
Build risk register, control matrix, owners, frequencies and evidence requirements.
PHASE 05
Implementation
Strengthen policies, procedures, technical safeguards and recurring control activities.
PHASE 06
Readiness
Validate evidence, remediate gaps, prepare stakeholders and coordinate examination readiness.
Documentation
Policies, standards, procedures, system description inputs, control narratives, risk documentation and supporting records.
Technical security
Identity and access management, endpoint protection, network security, cloud configuration, vulnerability management, logging and monitoring.
Operational controls
Access reviews, change management, incident response, backup and recovery, vendor management, security awareness and management review.
Evidence management
Evidence calendar, owner mapping, collection workflow, review, exception tracking, remediation and examination handoff.
SEARCH INTENT / EDUCATION / COMMERCIAL
SOC 2 Type 2 is an examination — not a certificate.
Buyers asking for SOC 2 Type 2 compliance usually want a Type 2 report: a described system, applicable Trust Services Criteria, control design, and evidence that relevant controls operated during a specified period. A licensed service auditor issues the opinion. CyberAtrix prepares the organization for that examination.
If you also need ISO/IEC 27001, pair the control set instead of running two disconnected programs.
FREE DOWNLOAD
SOC 2 Type 2 Readiness Checklist
A practical 40-point checklist covering scope, TSC selection, control design, evidence, ownership and examination readiness.
- Scope & system description prompts
- Trust Services Criteria selection guide
- Control owner & frequency matrix
- Evidence calendar template
- Pre-audit readiness self-assessment
28 / FAQ
SOC 2 Type 2 questions
Type II and Type 2 refer to the same examination idea: operating effectiveness over a defined period. SOC 2 is an attestation report, not an ISO-style certificate.
How can a SOC 2 Type 2 report help my organization?
It gives specified report users independent information about the defined system, relevant controls and whether those controls operated effectively throughout the examination period. This can support customer trust, procurement conversations and third-party risk discussions.
Who should consider a SOC 2 Type 2 report?
SaaS and cloud providers, technology and managed-service providers, data and business-process service organizations, enterprise vendors and other service organizations whose customers or partners need assurance about controls operating over time are common candidates. SOC 2 is not universally mandatory.
Does every company need SOC 2?
No universal law in the AICPA guide makes SOC 2 mandatory for every company. It is commonly pursued by service organizations whose customers, partners, contracts or risk requirements call for independent assurance.
Does a company need all five Trust Services Criteria?
No. A SOC 2 examination may address one or more categories. Security consists of the common criteria; the other categories add their applicable category-specific criteria.
Is three months the mandatory SOC 2 Type 2 observation period?
No. The AICPA guide states that Type 2 is for a specified period of time and that management determines the time frame. Three, six, nine and twelve months can be used as planning options when appropriate, but none is a universal AICPA-mandated period.
Can a company go directly to Type 2?
Yes. A prior Type 1 report is not inherently required. The organization must be prepared to demonstrate suitable control design and operating effectiveness for the defined Type 2 period.
Is SOC 2 a certification?
SOC 2 is an attestation examination and report, not an ISO-style certification. The independent service auditor issues an opinion based on the engagement and applicable criteria.
What is the difference between confidentiality and privacy?
Confidentiality applies to information designated as confidential. Privacy applies to personal information and addresses relevant processes around collection, use, retention, disclosure and disposal.
What happens if a control has a deviation?
The auditor evaluates deviations and their significance in the context of the examination, including the suitability of design, operating effectiveness, materiality and the overall evidence supporting the opinion.
Who writes the SOC 2 report?
Management prepares the system description and written assertion. The independent service auditor prepares and issues the service auditor's report, including the opinion and, for Type 2, the description of tests and results.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 examines the system description and whether controls were suitably designed as of a point in time. Type 2 also covers design and the description, and tests whether relevant controls operated effectively throughout a specified period.
How long does a SOC 2 Type 2 take?
Plan for readiness, plus a specified observation period (often 3, 6, 9 or 12 months), plus auditor testing and reporting. The observation period is usually the longest component.
How much does SOC 2 Type 2 cost?
Cost depends on TSC scope, system breadth, control maturity, evidence quality, subservice treatment and the service auditor engagement. CyberAtrix quotes readiness work separately from independent CPA examination fees.
Does CyberAtrix issue the SOC 2 Type 2 report?
No. CyberAtrix provides readiness, implementation and examination-preparation support. The report and opinion are issued by an independent licensed service auditor.
What are the Common Criteria CC1 through CC9 in a SOC 2 Type 2?
When Security is in scope, the common criteria are organized into nine control series: CC1 control environment, CC2 communication and information, CC3 risk assessment, CC4 monitoring activities, CC5 control activities, CC6 logical and physical access, CC7 system operations, CC8 change management and CC9 risk mitigation.
What is the difference between inclusive and carve-out treatment of subservice organizations?
Inclusive method brings the subservice organization's relevant controls into the examination scope of the system description. Carve-out excludes those controls and discloses that exclusion, while describing the services the subservice organization performs and the complementary controls expected at that subservice organization.
What are CUECs and CSOCs in a SOC 2 Type 2 report?
Complementary user entity controls are controls the user entity is expected to operate so that the service organization's controls can achieve their purpose. Complementary subservice organization controls are controls at a subservice organization that are necessary, in combination with the service organization's controls, to achieve commitments and system requirements.
Does a SOC 2 Type 2 report cover operating effectiveness over a specified period?
Yes. Type 2 addresses operating effectiveness of relevant controls throughout a specified period and includes the service auditor's description of tests performed and the results of those tests.
Does a SOC 2 Type 2 report replace ISO/IEC 27001 certification?
No. SOC 2 is an attestation report; ISO/IEC 27001 is a management-system standard with optional independent certification. They serve different assurance purposes and can be complementary. The control themes overlap.
What is a SOC 2 Type 2 examination period and how is it decided?
The examination period is a specified period of time agreed as part of the engagement. It is determined by management in coordination with the service auditor. Common planning options include 3, 6, 9 or 12 months, depending on engagement scope, customer expectations and control maturity.
29 / BUILD TYPE 2 WITH CONFIDENCE
Ready to Prove Your Controls Work?
Move beyond policies and point-in-time readiness. Build a SOC 2 Type 2 program around operating controls, defensible evidence, clear ownership and audit readiness.
Best-value approach • Transparent scope • Evidence-first execution
Written byRakesh H Kotian, CEO of CyberAtrix · ISO/IEC 27001 Lead Auditor & Lead Implementer.