If your company stores, processes, or transmits customer data, sooner or later a client will ask for your SOC 2 report. For software companies, managed service providers, payroll firms, and any business that handles sensitive information for others, SOC 2 has become the standard way to prove your security program is real.
SOC 2 is not a checklist with a fixed set of technologies. It is a framework built on principles, which gives you flexibility but also leaves many businesses unsure what is actually required. This article breaks down the key requirements in plain terms.
What SOC 2 Is
SOC 2 is an attestation developed by the American Institute of Certified Public Accountants (AICPA). An independent CPA firm reviews your controls and issues a report describing how well they are designed and, for a Type 2 report, how well they operated over a period of time. You do not get “certified.” You receive an auditor’s report that your customers can review.
The Five Trust Services Criteria
SOC 2 is organized around five Trust Services Criteria. Security is required. The others are added based on what you promise your customers.
- Security (required): protection against unauthorized access, both physical and logical.
- Availability: systems are up and usable as committed in your agreements.
- Processing Integrity: data is processed completely, accurately, and on time.
- Confidentiality: information designated as confidential is protected.
- Privacy: personal information is collected, used, and disposed of properly.
Key Control Areas Auditors Expect
Governance And Risk Management
You need documented security policies, defined roles and responsibilities, and a formal risk assessment that is updated at least annually. Leadership should show oversight of the security program.
Access Control
Users should have unique accounts, multi-factor authentication, and access based on job role. You must show that access is granted through an approval process, reviewed regularly, and removed promptly when employees leave.
Change Management
Changes to production systems, code, and infrastructure should be requested, reviewed, tested, and approved. Auditors will sample changes and look for evidence of each step.
System Monitoring
You need to detect and respond to security events. That usually means centralized logging, alerting, endpoint protection, and vulnerability scanning. Services like SIEM and log analysis and vulnerability scanning provide much of the evidence auditors want to see.
Incident Response
A written incident response plan, a defined team, and records of how incidents were handled. Many companies also run a tabletop exercise each year to prove the plan works.
Vendor Management
You are responsible for the vendors that touch your customers’ data. Keep an inventory of critical vendors, review their security reports, and document your assessment.
Backup And Business Continuity
Especially if you include Availability, you will need backup procedures, tested restores, and a business continuity and disaster recovery plan.
Human Resources Security
Background checks where appropriate, signed confidentiality and acceptable use agreements, and security awareness training for all employees.
Type 1 Versus Type 2
A Type 1 report evaluates whether your controls are designed properly at a single point in time. A Type 2 report evaluates whether those controls actually operated effectively over an observation period, typically three to twelve months. Most enterprise customers ask for Type 2, so many companies use a Type 1 as a first milestone.
Where Companies Usually Struggle
- Policies exist, but nobody follows or documents them
- Access reviews are not performed or not recorded
- Logs are collected but never reviewed
- Offboarding is slow, leaving active accounts for former employees
- Evidence is scattered across email and spreadsheets
How To Prepare
Start with a readiness assessment or gap analysis. Decide which Trust Services Criteria apply, map your current controls, and close the gaps before the audit window begins. Then choose tools and services that generate evidence automatically, so you are not scrambling for screenshots at audit time.
CTS Companies helps Michigan businesses prepare for and maintain SOC 2 compliance. We handle the technical controls, monitoring, and documentation that auditors look for, so your team can focus on running the business. Talk to an expert about a SOC 2 readiness review.