What is SOC 2?
SOC 2 is an examination report on a service organisation's controls, issued by a US Certified Public Accountant (CPA) under AICPA requirements. SOC stands for System and Organization Controls, a suite of AICPA services for service organisations' controls. SOC 1 covers controls relevant to customers' financial reporting and SOC 2 the Trust Services Criteria; SOC 3 is a general-use report.
A SOC 2 report is not a certificate. There is no certification body and no accreditation as with ISO/IEC 27001, but an auditor's opinion on a described system. The BSI, Germany's Federal Office for Information Security, names SOC 2 as the US counterpart to examinations under ISAE 3000, on which the C5 attestation is also based (BSI: C5 introduction, in German).
Which categories does a SOC 2 report examine?
The Trust Services Criteria fall into five categories:
| Category | Subject |
|---|---|
| Security | protection of systems and information against unauthorised access and disclosure |
| Availability | availability of the system for operation and use |
| Processing Integrity | completeness, accuracy and timeliness of processing |
| Confidentiality | protection of information designated as confidential |
| Privacy | handling of personal information |
A report speaks only to the categories that were actually examined. Which ones those are is stated in the description of the system and in the auditor's opinion.
What distinguishes Type 1 and Type 2?
A Type 1 report assesses whether controls were suitably designed as of a specific date. A Type 2 report also assesses whether they operated effectively over a reporting period and includes the auditor's tests and their results. Only a Type 2 report therefore shows whether the controls worked in day-to-day operation (AICPA: SOC 2 report review). Both types refer to a past date or period, not to the current state.
How to check a SOC 2 report
Work through these steps for each service you use and file the result in vendor management:
| Step | Passed if | What to file |
|---|---|---|
| 1. Scope | the service and regions you use appear in the system description | reference in the report |
| 2. Categories | the categories your use case needs were examined, for example Availability for a service with high availability needs | list of examined categories |
| 3. Type and period | Type 2 report; for the time since the end of the reporting period, a written statement from the provider confirms that controls have not changed materially | reporting period, statement, date of the next report |
| 4. Opinion and exceptions | the opinion is unqualified, and you have assessed every exception listed in the test section for your case | assessment per exception |
| 5. Customer controls | the controls the provider assumes on your side (complementary user entity controls) are in place and have an owner | list with owners |
| 6. Subcontractors | for subservice organisations the report carves out, separate evidence exists | list with evidence per subcontractor |
A report that fails step 1 says nothing about your service. In that case ask for a report with a matching scope, or assess the service with your own questions.
What applies to buyers in Germany?
In Germany, buyers read a SOC 2 report alongside the BSI C5 criteria catalogue. According to the BSI, coordinating SOC 2 and C5 audits in organisation and timing is more efficient, because evidence can then serve both reports (section 3.3 of the C5:2026 criteria catalogue, in German). According to the BSI, however, merely referring to criteria in other standards is not enough to show that the C5 criteria are covered.
For social and health data in the cloud, § 393 SGB V (German Social Code, Book V) requires a C5 attestation. As a substitute, the C5 Equivalence Ordinance (C5-Gleichwertigkeitsverordnung) accepts attestations or certifications under ISO/IEC 27001, ISO 27001 on the basis of IT-Grundschutz and the Cloud Controls Matrix 4.0, each with an action plan. SOC 2 is not among them. What a C5 attestation and an ISO 27001 certificate each prove is shown in the comparison BSI C5 vs ISO 27001.
SOC 2 as a requirement catalogue in Rizzqo
SOC 2 is supported in Rizzqo; its catalogue is enabled when a customer needs it. Its requirements then attach to supporting assets by category and subcategory. An assigned owner answers them and finalises each answer with name and timestamp; evidence can be attached, such as a provider's SOC 2 report on the asset that represents its service.
Daily snapshots record the state of each day. For a reporting period, this shows from when a requirement was finalised as fulfilled.