Question 1

What is SOC 2?

Accepted Answer

SOC 2 is an AICPA assurance engagement that reports on controls at a service organisation relevant to security, availability, processing integrity, confidentiality or privacy, based on the Trust Services Criteria.

Question 2

Who uses SOC 2 reports?

Accepted Answer

Customers of service providers, their auditors and procurement teams rely on SOC 2 reports to assess the controls at service organisations that host or process their data.

Question 3

What are the Trust Services Criteria?

Accepted Answer

The Trust Services Criteria define common criteria for security and additional criteria for availability, processing integrity, confidentiality and privacy. Security is always in scope; other categories are selected based on service commitments.

Question 4

What is the difference between Type 1 and Type 2?

Accepted Answer

A Type 1 report addresses the suitability of the design of controls at a specific date. A Type 2 report also addresses the operating effectiveness of controls over a period, typically six or twelve months.

Question 5

What is the system description?

Accepted Answer

The system description explains the services, boundaries, infrastructure, software, people, procedures and data of the system under review. It is a key part of the SOC 2 report.

Question 6

What are CUECs?

Accepted Answer

Complementary User Entity Controls are controls that customers must implement to achieve the criteria of the service organisation's report, such as managing their own user accounts in the service.

Question 7

How does SOC 2 relate to ISO 27001?

Accepted Answer

SOC 2 and ISO 27001 are highly complementary. ISO 27001 provides a certifiable ISMS, while SOC 2 provides an assurance report on specific Trust Services Criteria. Many controls are shared.

Question 8

How does SOC 2 relate to SOC 1?

Accepted Answer

SOC 1 focuses on controls at a service organisation relevant to user entities' internal control over financial reporting. SOC 2 addresses operational and security criteria and is not aimed at financial reporting.

Question 9

What is a SOC 3 report?

Accepted Answer

A SOC 3 report is a short, general-use summary that can be shared publicly. It is based on a SOC 2 engagement but without detailed testing results.

Question 10

How does Basenorm support SOC 2?

Accepted Answer

Basenorm centralises Trust Services Criteria, system description, evidence collection, auditor collaboration and exception management, with mappings to ISO 27001, NIST and other frameworks.

SOC 2 Reports
for Security and Trust

Trust Services Criteria and Scope

Trust Services Criteria

Type 1 vs Type 2 Comparison

Type 1 and Type 2 Evidence

Auditor Collaboration and Continuous Compliance

Auditor Evidence Package

Ready to run SOC 2 continuously?

Frequently Asked Questions

SOC 2 Reportsfor Security and Trust