What is System and Organization Controls (SOC) 2 report?
In short
A System and Organization Controls (SOC) 2 report is a service auditor's report on a service organization's controls relevant to the trust services criteria: security, availability, processing integrity, confidentiality and privacy.
Key takeaways
- Type 1 covers design at a point in time; Type 2 adds operating effectiveness over a period.
- Its use is restricted to parties with enough understanding, such as customers and regulators.
- A SOC 3 report is a general-use summary on the same criteria.
Where it's tested
ISC: System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
Which Trust Services Criterion must be included in every SOC 2 engagement?