SOC 2 is an attestation report in which an independent CPA firm gives an opinion on a service organization's controls, measured against the AICPA's trust services criteria. It is not a certification. This glossary defines, in plain words, the terms you meet when you read or prepare one.
The basics
SOC 2. A report on controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy (AICPA).
AICPA. The American Institute of CPAs, which sets the criteria and attestation standards.
Service organization. A company that provides a service whose controls matter to customers, such as a software provider.
Service auditor. The independent CPA firm that examines the controls and issues the report. Software cannot issue a SOC 2 report.
Trust services criteria. The AICPA's criteria for judging controls. They are outcome based: they ask whether controls give reasonable assurance that objectives are met. They were issued in 2017 and revised in 2022 (per AICPA's published materials).
The five categories
Security. Protection against unauthorized access. This is the common baseline and, in practice, the category nearly every report includes.
Availability. The system is up as committed.
Processing integrity. Processing is complete, valid and timely.
Confidentiality. Information designated confidential is protected.
Privacy. Personal information is handled as promised.
You choose which categories to include in scope.
Type I and Type II
Type I. A report on whether controls are suitably designed at one point in time.
Type II. A report that also tests whether controls operated effectively over a period, usually several months. AICPA's page we fetched did not define these two terms, so confirm the wording in the AICPA guide.
Buyers typically value Type II more, because it shows controls working over time. Do not describe a report you do not hold, and state which type and period when you cite one.
The report parts
System description. Management's account of the services, infrastructure, software, people, procedures and data in scope. AICPA publishes description criteria for it, last revised in 2022 (AICPA).
Management assertion. Management's statement that the description is fair and the controls were effective.
Auditor's opinion. The CPA's conclusion. It may be unqualified (clean) or qualified.
Test results. The tests the auditor ran and what they found, including exceptions.
Exception. A case where a control did not operate as stated.
Terms that surprise newcomers
Subservice organization. A vendor you rely on, such as a cloud host. The report either includes it or carves it out.
Carve-out method. The report excludes the subservice organization's controls and lists them separately.
Complementary user entity controls. Controls your customers must run for the system to meet its criteria.
Bridge letter. A short management statement covering the gap between the end of a report period and today. It is not an audit.
Control. An action or process that reduces a risk.
Evidence. Dated proof that the control ran.
Observation window. The period a Type II covers.
What to do
- Pick the categories your customers need, usually starting with security.
- Define the system boundary and list subservice organizations.
- Decide between a Type I first or going straight to Type II.
- Gather evidence on a schedule from day one of the window.
- Read other vendors' reports for exceptions and user entity controls.
- Describe your own status precisely: type, period, categories.
Quick check
Is SOC 2 a certification?
No. It is an attestation report with an auditor's opinion. People often call it a certification, but the distinction matters in contracts.
What is a carve-out?
It is when a report excludes a subservice organization's controls. You then need that vendor's own report to cover the gap.
Sources
Last reviewed: 18 October 2026.
