What is SOC 2, and why do customers ask for it?

SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks. 2 is an attestation report in which an independent auditor examines a service organisation’s controls against the Trust Services Criteria. The AICPA, the US accounting profession’s standards body, defines it. Security is always in scope; availability, processing integrity, confidentiality and privacy can be added. The report describes the system, the controls the company claims, the auditor’s tests and any exceptions found, and it is normally shared with customers under a non-disclosure agreement. Customers, especially in North America, ask for it because it lets them rely on an independent review instead of auditing each supplier themselves. It is not a certification and there is no pass mark: you read the auditor’s opinion, the scope and the exceptions. When a supplier sends you one, check the period covered, which services and locations are in scope, which criteria were included, and the complementary controls you are expected to run on your side. NetSenX does not hold a SOC 2 report today; SOC 2 Type I is in preparation.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics