# What is SOC 2, and why do customers ask for it?

SOC 2 is an attestation report in which an independent auditor examines a service organisation’s controls against the Trust Services Criteria. The AICPA, the US accounting profession’s standards body, defines it. Security is always in scope; availability, processing integrity, confidentiality and privacy can be added. The report describes the system, the controls the company claims, the auditor’s tests and any exceptions found, and it is normally shared with customers under a non-disclosure agreement. Customers, especially in North America, ask for it because it lets them rely on an independent review instead of auditing each supplier themselves. It is not a certification and there is no pass mark: you read the auditor’s opinion, the scope and the exceptions. When a supplier sends you one, check the period covered, which services and locations are in scope, which criteria were included, and the complementary controls you are expected to run on your side. NetSenX does not hold a SOC 2 report today; SOC 2 Type I is in preparation.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/what-is-soc-2

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [What is the difference between a SOC 2 Type 1 and a Type 2 report?](https://netsenx.com/en/faq/soc-2-type-1-vs-type-2)
- [Do we need ISO 27001 or SOC 2?](https://netsenx.com/en/faq/iso-27001-or-soc-2-which-do-we-need)
- [What is ISO/IEC 42001?](https://netsenx.com/en/faq/what-is-iso-42001)
- [What is IEC 62443, and do we need it?](https://netsenx.com/en/faq/what-is-iec-62443)
- [Does an ISO 27001 certificate mean we meet NIS2?](https://netsenx.com/en/faq/does-iso-27001-cover-nis2)