SOC 2 — System and Organization Controls for Trust Services Criteria

Why does it matter?

SOC 2 is the report enterprise buyers ask a software or service provider for before they sign, and the one their own auditors and regulators accept as evidence about an outsourced system. Because the Trust Services Criteria are published and the report format is fixed by AT-C 205 and the AICPA guide, a reader can compare two providers' reports criterion by criterion and read the exceptions the auditor found. The AICPA has also warned, in a notice on its SOC pages, that it is examining allegations about the business practices of a compliance vendor offering SOC services and that auditors who do not follow professional standards or peer review face action, so the credibility of a report depends on the CPA firm that signs it.

Key benefits include:

• Published criteria

The 2017 Trust Services Criteria (TSP section 100) are a free download from the AICPA, so a service organization can design controls and a customer can read the criteria before the report arrives.

• Scope chosen by the service organization

Security is the common criteria set applied in every report; availability, processing integrity, confidentiality and privacy are added when the service organization puts them in scope.

• A description with its own criteria

DC section 200 is the AICPA's set of benchmarks for preparing and evaluating the description of the service organization's system, so descriptions can be compared across providers.

• Type 1 and type 2

A type 1 report covers design as of a date; a type 2 report covers design and operating effectiveness over a period and lists the tests performed and their results.

• Not a general-use report

A SOC 2 report contains detailed descriptions of controls and test results; the AICPA's general-use alternative without that detail is the SOC 3 report.

How does it work?

The Trust Services Criteria define each category. Security: information and systems are protected against unauthorized access, unauthorized disclosure of information and damage to systems that could compromise availability, integrity, confidentiality and privacy. Availability: information and systems are available for operation and use to meet the entity's objectives. Processing integrity: system processing is complete, valid, accurate, timely and authorized. Confidentiality: information designated as confidential is protected as committed or agreed. Privacy: personal information is collected, used, retained, disclosed and disposed of to meet the entity's objectives. The criteria are supplemented by points of focus, drawn from the COSO framework, that describe characteristics of each criterion without being mandatory.

The common criteria follow the five COSO components: control environment (CC1), communication and information (CC2), risk assessment (CC3), monitoring activities (CC4) and control activities (CC5), each criterion citing the COSO principle it implements. Four supplemental series then cover logical and physical access controls (CC6), system operations (CC7), change management (CC8) and risk mitigation (CC9). The additional criteria for availability (A1), processing integrity (PI1), confidentiality (C1) and privacy (P1 notice, P2 choice and consent, P3 collection, P4 use, retention and disposal, P5 access, P6 disclosure and notification, P7 quality, P8 monitoring and enforcement) apply only when that category is in scope.

The examination is an AT-C 205 engagement: the service auditor obtains management's written assertion, evaluates the description against DC section 200, assesses whether the controls were suitably designed to provide reasonable assurance of achieving the entity's objectives based on the applicable criteria, and in a type 2 engagement tests operating effectiveness over the period and reports deviations. The criteria themselves note that applying them requires judgment and that some points of focus may not be relevant to a given entity or engagement. The October 2022 guide reflects SSAE No. 20 and SSAE No. 21 and also covers the preparation of a SOC 3 report from the same engagement.

Key Elements

• Trust Services Criteria (TSP section 100)

The 2017 criteria with revised points of focus 2022: common criteria CC1 to CC9 and additional criteria for availability, processing integrity, confidentiality and privacy.

• Description Criteria (DC section 200)

The 2018 benchmarks, with 2022 implementation guidance, used when preparing and evaluating the description of the service organization's system in a SOC 2 examination.

• Management's assertion

Management's written statement that the description is presented in accordance with DC 200 and that the controls were suitably designed and, for type 2, operated effectively.

• Service auditor's report

The opinion on the description, design and operating effectiveness under AT-C 105 and 205, with the tests and results in a type 2 report.

• Points of focus

Characteristics of each criterion, drawn from the COSO framework, that help management and the auditor judge whether controls are suitably designed and operating; not every point of focus applies to every entity.

• Scope and period

The categories in scope, the system boundary, and the as-of date (type 1) or examination period (type 2) stated in the report.

What does it cover?

SOC 2 applies to any service organization whose system processes, stores or transmits information for customers: cloud infrastructure and platform providers, software-as-a-service companies, managed service and security providers, data centers, payroll and HR platforms, payment and fintech processors, healthcare IT and business process outsourcers. The Trust Services Criteria can also be applied across an entire entity, a division, a function or a particular type of information, which is how the same criteria support the AICPA's SOC for Cybersecurity and SOC for Supply Chain examinations. Controls relevant to user entities' financial reporting are outside SOC 2 and belong in a SOC 1 engagement.

What are its objectives?

The engagement gives customers and business partners the information they need to identify, assess and address the risks of using a service organization's system. In practice it aims to:

State the entity's objectives for the system that the controls are meant to achieve.

Describe the system against DC section 200 so that readers know what was examined.

Report, criterion by criterion, whether controls were suitably designed and operated effectively for the categories in scope.

Disclose every deviation found in testing.

Give customers and business partners the information they need to assess and address the risks of using the service.

Framework in Context

SOC 2 sits in the AICPA's SOC suite between SOC 1, which covers controls relevant to user entities' financial reporting under AT-C 320, and SOC 3, the general-use report on the same Trust Services Criteria. Its common criteria are built on the COSO Internal Control framework, and because the criteria are outcome statements rather than a control list, organizations usually map their ISO/IEC 27001 Annex A controls, NIST CSF outcomes or CIS Controls to the criteria to show coverage. A SOC 2 report is accepted as third-party assurance in vendor risk programs that also ask for ISO/IEC 27001 certificates, and the same Trust Services Criteria underlie the AICPA's SOC for Cybersecurity and SOC for Supply Chain examinations. SmartSuite itself holds a SOC 2 Type II attestation report, described on its security page.

Common Framework Mappings

Organizations map SOC 2 criteria to the frameworks below so that one control set and evidence library answers the service auditor, ISO/IEC 27001 auditors and customer questionnaires.

Mapped frameworks include:

CIS Controls v8.1

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27018

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5