01
Service Organization
An organization that provides services or functions to user entities through people, technology and processes.
SOC 2 TYPE 2 • READINESS • IMPLEMENTATION • ATTESTATION SUPPORT
Turn Your Controls Into Proven Assurance.
Understand SOC 2 from the ground up—what it is, how Trust Services Criteria work, what Type 2 actually tests, how observation periods are selected, what the CPA/service auditor does, and how CyberAtrix can prepare your organization for the examination.
Operating EffectivenessTrust Services CriteriaEvidence-FirstCPA Attestation
SOC2TYPE 2
✓
CONTROLASSURED
01 / THE FOUNDATION
What is SOC 2?
SOC 2 is a service-organization examination focused on controls relevant to security, availability, processing integrity, confidentiality and/or privacy. It helps report users assess and address risks arising from their relationship with a service organization.
SOC 2SYSTEM & ORGANIZATION CONTROLS
It is an examination of a system, controls and management assertion.
The organization defines the system and its boundaries, describes relevant services and controls, identifies applicable Trust Services Criteria, and management makes an assertion. The independent service auditor then obtains evidence and forms an opinion under the applicable attestation standards.
01System
02Scope
03Controls
04Assertion
05Evidence
06Opinion
02
System
The system includes infrastructure, software, people, procedures and data used to achieve business objectives.
03
Controls
Policies and procedures within the system of internal control designed to provide reasonable assurance that commitments and requirements are achieved.
04
Report Users
Specified parties use the report to understand the system and assess risks associated with the service organization.
02 / TYPE 2 EXPLAINED
What is SOC 2 Type 2?
Type 2 addresses the system description and suitability of control design, and adds whether the controls operated effectively throughout a specified period. It also includes a detailed description of the service auditor's tests of controls and their results.
POINT IN TIME
SOC 2 Type 1
Examines whether the system was designed and implemented as of a point in time and whether relevant controls were suitably designed as of that point.
VS
SPECIFIED PERIOD
SOC 2 Type 2
Also examines the description and control design, but additionally tests whether controls operated effectively throughout the specified examination period.
Key distinction: Type 1 answers “what was designed and in place at a point in time?” Type 2 goes further: “did the relevant controls operate effectively throughout the specified period?”
03 / WHY TYPE 2
Why do organizations pursue SOC 2 Type 2?
SOC 2 is commonly requested when customers, business partners or other specified report users need information about the design, operation and effectiveness of controls at a service organization.
01
Enterprise Trust
Provide customers with independent assurance about controls relevant to the services they rely on.
02
Procurement Readiness
Support security due diligence and vendor-risk conversations with a structured assurance report.
03
Operational Discipline
Make controls repeatable, owned, monitored and supported by evidence rather than documentation alone.
04
Risk Visibility
Help report users understand the system, commitments, requirements and controls relevant to their relationship with you.
04 / TRUST SERVICES CRITERIA
What are TSC?
Trust Services Criteria are the criteria used to evaluate the suitability of control design and, in Type 2, operating effectiveness for the Trust Services category or categories within scope.
🛡️
Security
Information and systems are protected against unauthorized access, unauthorized disclosure and damage that could affect the ability to meet objectives.
COMMON CRITERIA / CC⚡
Availability
Information and systems are available for operation and use to meet the entity's objectives.
COMMON + A SERIES⚙️
Processing Integrity
System processing is complete, valid, accurate, timely and authorized to meet the entity's objectives.
COMMON + PI SERIES🔐
Confidentiality
Information designated as confidential is protected to meet the entity's objectives.
COMMON + C SERIES◉
Privacy
Personal information is collected, used, retained, disclosed and disposed of to meet the entity's objectives.
COMMON + P SERIES✓ Do you need all five?
No. A SOC 2 examination may address one or more of the five categories. Security is represented by the common criteria; when Availability, Processing Integrity, Confidentiality or Privacy is in scope, the common criteria are combined with the applicable category-specific criteria.
⚠ Choosing scope matters
The right TSC scope should reflect your services, commitments, system requirements, risks, customer expectations and the information your report users need. More categories mean broader control scope and evidence requirements.
05 / THE TSC ARCHITECTURE
How the Common Criteria fit together
The AICPA guide organizes the common criteria into five internal-control classifications, with control activities further broken into access, operations, change management and risk mitigation areas.
CC1
Control Environment
Integrity, ethics, board oversight, structure, competence and accountability.
CC2
Communication & Information
Relevant quality information and internal/external communication needed for control operation.
CC3
Risk Assessment
Identification and assessment of risks that could prevent commitments and objectives from being achieved.
CC4
Monitoring Activities
Ongoing and separate evaluations plus timely communication and remediation of deficiencies.
CC5
Control Activities
Control activities selected and developed to mitigate risks. The AICPA guide further identifies logical and physical access controls, system operations, change management and risk mitigation within this area.
06 / COSO CONNECTION
What is a COSO Principle?
COSO is the Committee of Sponsoring Organizations of the Treadway Commission. The 2017 Trust Services Criteria were structured and aligned with the COSO 2013 Internal Control—Integrated Framework and its 17 principles.
COSO • 5 COMPONENTS • 17 PRINCIPLES
Internal control, translated into SOC 2 criteria.
COSO principles describe fundamental elements that must be present or functioning for internal control to be considered effective. SOC 2 maps the common criteria to this structure.
Practical meaning: COSO gives the internal-control architecture; TSC applies that architecture to service-organization assurance.
01 • CONTROL ENVIRONMENTIntegrity and ethical values.
02 • CONTROL ENVIRONMENTBoard exercises oversight responsibility.
03 • CONTROL ENVIRONMENTStructures, reporting lines, authority and responsibility.
04 • CONTROL ENVIRONMENTAttracts, develops and retains competent individuals.
05 • CONTROL ENVIRONMENTHolds individuals accountable for internal-control responsibilities.
06 • RISK ASSESSMENTSpecifies suitable objectives.
07 • RISK ASSESSMENTIdentifies and analyzes risks.
08 • RISK ASSESSMENTAssesses fraud risk.
09 • RISK ASSESSMENTIdentifies and assesses significant change.
10 • CONTROL ACTIVITIESSelects and develops control activities to mitigate risks.
11 • CONTROL ACTIVITIESSelects and develops general control activities over technology.
12 • CONTROL ACTIVITIESDeploys control activities through policies and procedures.
13 • INFORMATIONObtains or generates relevant, quality information.
14 • INFORMATIONCommunicates internal-control information internally.
15 • INFORMATIONCommunicates relevant matters externally.
16 • MONITORINGSelects, develops and performs ongoing/separate evaluations.
17 • MONITORINGEvaluates and communicates control deficiencies in a timely manner.
07 / OBSERVATION PERIOD
3, 6, 9 or 12 months?
The AICPA guide says a Type 2 examination is performed for a specified period of time and that management determines the time frame. It does not prescribe a universal 3-, 6-, 9- or 12-month observation period.
SHORTER PERIOD
3 Months
Can be commercially useful when a customer or engagement requirement accepts a shorter period. Less historical operating evidence is covered than with a longer period.
BALANCED
6 Months
A common planning option for organizations seeking a broader operating window while keeping the evidence history manageable.
EXTENDED
9 Months
Provides a longer operating history and more evidence across recurring controls and changing conditions.
LONGER ASSURANCE WINDOW
12 Months
Provides the broadest of these four periods and can demonstrate control operation across a full annual cycle where appropriate.
Important: These four durations are planning options, not AICPA validity rules or mandatory Type 2 periods. The appropriate period should be determined from engagement scope, customer expectations, control maturity, business cycles and the requirements agreed with the service auditor.
08 / SOC 2 TYPE 2 IMPLEMENTATION
From Gap → Control → Evidence → Audit
A practical implementation program should prepare the organization to operate the controls consistently—not merely document them.
01
Scope02
Gap Assessment03
Risk & Control Design04
Policies05
Implementation06
Operate07
Evidence08
Readiness09
CPA Examination01
Scope & System
Define the service, system boundaries, components, commitments, requirements, applicable TSC categories and relevant stakeholders.
02
Control Implementation
Design and implement policies, processes and technical controls with owners, frequencies, evidence requirements and exception handling.
03
Operating Period
Operate the controls consistently, collect evidence, monitor deviations, remediate issues and maintain the system description as needed.
09 / TYPE 2 EVIDENCE
What does the auditor actually test?
In Type 2, the service auditor designs and performs procedures to obtain sufficient appropriate evidence about operating effectiveness and describes the tests and results in the report.
Typical control evidence
Access reviews
User onboarding/offboarding
Vulnerability management
Patch evidence
Change approvals
Incident records
Backup evidence
Monitoring records
Risk assessments
Vendor reviews
Security training
Management reviews
Type 2 testing concepts
Inquiry
Inspection
Observation
Reperformance
Sampling
Timing of tests
Extent of tests
Reliability of information
Deviation evaluation
Materiality
Remediation response
Written representations
10 / WHO DOES WHAT?
Management, CyberAtrix & the CPA
SOC 2 is not simply a consultant-issued certificate. Management owns the system and assertion; the independent service auditor performs the attestation examination and issues the report.
M
Management
Defines scope, prepares the system description and written assertion, operates the system and controls, provides evidence and representations, and remains responsible for the underlying system and controls.
C
CyberAtrix
Supports readiness and implementation: gap assessment, risk/control mapping, policies, control implementation, evidence workflows, remediation and audit preparation.
A
Service Auditor / CPA
Performs the independent examination under the applicable attestation standards, obtains evidence, evaluates the description and controls, performs tests for Type 2 and issues the service auditor's report.
11 / CPA & ATTESTATION
What is a CPA? What is CPA attestation?
CPA — Certified Public Accountant
A CPA is a professional accountant licensed under applicable jurisdictional requirements. In a SOC 2 examination, the AICPA standards refer to the practitioner; this guide uses the term service auditor for the practitioner performing the SOC 2 examination.
- Must meet applicable professional and ethical requirements.
- The engagement team must have appropriate competence and capabilities.
- Independence and professional judgment are central to an examination engagement.
What is CPA attestation?
An attestation engagement is based on an assertion by a responsible party about whether subject matter is measured or evaluated against suitable criteria. In SOC 2, management is the responsible party and provides a written assertion; the service auditor obtains sufficient appropriate evidence and expresses an opinion.
- Applicable U.S. SOC 2 examinations use the AICPA attestation standards, including AT-C 105 and AT-C 205.
- Type 2 adds operating-effectiveness testing and a description of tests and results.
- The SOC 2 report is restricted to specified parties who have sufficient knowledge to understand it.
12 / WHAT IS IN THE REPORT?
The SOC 2 Type 2 report structure
The AICPA guide identifies three key components in the SOC 2 report, with Type 2 adding operating-effectiveness subject matter and detailed tests/results.
01
System Description
Management's description of the system throughout the examination period, prepared using the applicable description criteria.
02
Management Assertion
Management's assertion addresses the description, suitability of control design and, for Type 2, operating effectiveness throughout the period.
03
Service Auditor Report
The auditor's opinion plus the Type 2 description of tests of controls and the results of those tests.
Report use: SOC 2 reports are intended for specified parties with sufficient knowledge and understanding of the service organization, its services, system, controls, criteria and related risks.
13 / IMPORTANT SOC 2 CONCEPTS
Other areas that can affect your Type 2
01
System Boundaries
Clearly define what is inside the examination and how system components support the services in scope.
02
Complementary User Entity Controls
Some controls assumed in the design may need to be performed by the customer/user entity; these responsibilities matter to report users.
03
Subservice Organizations
Vendors may perform functions that form part of the service organization's system. Inclusive and carve-out approaches can affect the examination.
04
System Changes
Changes during the Type 2 period can affect testing, control populations, descriptions and evaluation of operating effectiveness.
14 / BUSINESS VALUE
How does a SOC 2 Type 2 report help your organization?
A Type 2 report gives specified report users independent information about the system, relevant controls and whether those controls operated effectively throughout the examination period. That evidence can strengthen customer trust, support procurement conversations and reduce the need to explain your control environment from scratch.
TYPE
2
2
FROM DOCUMENTATION → TO EVIDENCE
Turn your control environment into a credible assurance story.
Instead of relying only on policies, questionnaires or point-in-time claims, your organization can provide a formal independent report covering the defined system, applicable criteria, control design and operating effectiveness for the specified period.
Win and retain enterprise customers
Give customers and partners structured assurance about controls relevant to the services they depend on.
Demonstrate operating effectiveness
Show that relevant controls were not merely designed, but operated throughout the defined examination period.
Reduce security-review friction
Use an independent assurance report as a stronger response to customer security reviews and vendor-risk requests.
Strengthen internal discipline
Establish clearer ownership, repeatable evidence collection, monitoring and remediation around your control environment.
01Independent examination
02Specified-period evidence
03Control test results
04Management assertion
05Service auditor opinion
06Customer-ready assurance
15 / WHO SHOULD PURSUE IT?
Who should get a SOC 2 Type 2 report?
SOC 2 is not an ISO-style certification. It is an attestation examination and report. Organizations should consider pursuing Type 2 when their customers, partners, contracts, procurement teams or risk profile require credible evidence about controls operating over time.
01
SaaS & Cloud Providers
Especially organizations hosting, processing or managing customer information through cloud-based products and platforms.
HIGH FIT
02
Technology & Managed Services
MSPs, IT service providers, infrastructure providers and technology partners whose customers depend on their controls.
HIGH FIT
03
Data & Business Process Services
Organizations handling customer data, operational processes or other services where control assurance affects third-party risk.
STRONG FIT
04
Enterprise Vendors
Suppliers entering larger procurement programs where security and control assurance is a recurring commercial requirement.
STRONG FIT
05
Fintech & Digital Platforms
Platforms with heightened expectations around security, availability, processing integrity, confidentiality or privacy.
SCOPE DEPENDENT
06
Growth-Stage Companies
Companies preparing for enterprise expansion, strategic partnerships or customer due diligence that need a repeatable assurance program.
GROWTH READY
Good fit ≠ mandatory.The decision should be based on customer requirements, contractual expectations, risk, service commitments, system scope and the value the report provides to intended users.
16 / CYBERATRIX ADVANTAGE
How CyberAtrix will help you achieve your SOC 2 Type 2 report
CyberAtrix helps you move from readiness to an evidence-backed operating control environment—while keeping scope, ownership, remediation and audit preparation aligned.
01AssessScope • Gap • Risk
→02DesignTSC • Controls • Policies
→03ImplementOwners • Processes • Tools
→04OperateEvidence • Monitoring • Remediation
→05PrepareAudit Readiness • CPA Support
Performance-first execution
Focused workstreams, practical prioritization and evidence-driven execution designed to keep the engagement moving.
Security + GRC expertise
Translate technical security, governance and operational practices into controls, evidence and an examination-ready environment.
Delivery discipline
Clear ownership, milestones, remediation tracking and structured evidence workflows so teams know what needs to happen next.
Competitive, value-focused costing
Right-size the scope, avoid unnecessary control overhead and build a practical roadmap aligned to your business and budget.
17 / FAQ
SOC 2 Type 2 questions
How can a SOC 2 Type 2 report help my organization?
It gives specified report users independent information about the defined system, relevant controls and whether those controls operated effectively throughout the examination period. This can support customer trust, procurement conversations and third-party risk discussions.
Who should consider a SOC 2 Type 2 report?
SaaS and cloud providers, technology and managed-service providers, data and business-process service organizations, enterprise vendors and other service organizations whose customers or partners need assurance about controls operating over time are common candidates. SOC 2 is not universally mandatory.
Does every company need SOC 2?
No universal law in the AICPA guide makes SOC 2 mandatory for every company. It is commonly pursued by service organizations whose customers, partners, contracts or risk requirements call for independent assurance.
Does a company need all five Trust Services Criteria?
No. A SOC 2 examination may address one or more categories. Security consists of the common criteria; the other categories add their applicable category-specific criteria.
Is three months the mandatory SOC 2 Type 2 observation period?
No. The AICPA guide states that Type 2 is for a specified period of time and that management determines the time frame. Three, six, nine and twelve months can be used as planning options when appropriate, but none is a universal AICPA-mandated period.
Can a company go directly to Type 2?
Yes. A prior Type 1 report is not inherently required. The organization must be prepared to demonstrate suitable control design and operating effectiveness for the defined Type 2 period.
Is SOC 2 a certification?
SOC 2 is an attestation examination and report, not an ISO-style certification. The independent service auditor issues an opinion based on the engagement and applicable criteria.
What is the difference between confidentiality and privacy?
Confidentiality applies to information designated as confidential. Privacy applies to personal information and addresses relevant processes around collection, use, retention, disclosure and disposal.
What happens if a control has a deviation?
The auditor evaluates deviations and their significance in the context of the examination, including the suitability of design, operating effectiveness, materiality and the overall evidence supporting the opinion.
Who writes the SOC 2 report?
Management prepares the system description and written assertion. The independent service auditor prepares and issues the service auditor's report, including the opinion and, for Type 2, the description of tests and results.
18 / BUILD TYPE 2 WITH CONFIDENCE
Ready to Prove Your Controls Work?
Move beyond policies and point-in-time readiness. Build a SOC 2 Type 2 program around operating controls, defensible evidence, clear ownership and audit readiness.
Best-value approach • Transparent scope • Evidence-first execution