What category of report this is
SOC 2 is part of the AICPA System and Organization Controls (SOC) suite of services. A SOC 2 examination is a "report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy." A CPA firm produces the report under AICPA professional standards.
AICPA describes SOC 2 reports as intended for users who need detailed information and assurance about those controls. Those controls cover the systems that a service organization uses to process the data of users. SOC 2 is not a U.S. statute. It is not a government Authorization.
Trust Services Criteria categories
AICPA uses the 2017 Trust Services Criteria (With Revised Points of Focus, 2022) as the criteria family for these examinations. The categories are security, availability, processing integrity, confidentiality, and privacy. Security is the category included in a SOC 2 examination. Availability, confidentiality, processing integrity, and privacy are additional categories that a report can include.
The categories that a given report actually covers are a fact in that report. They are not a logo.
The described system and the period
A SOC 2 report covers a described system. A Type II report also covers a period. A review checks the system description boundaries. It checks which Trust Services Criteria categories were in scope. It checks complementary user-entity controls, carve-outs, and subservice organizations. It also checks the opinion language. A homepage shield without that scope is folklore.
Type I is not Type II
Type I is a report about the suitability of the design of controls as of a specified date. That is a point in time.
Type II is a report about the suitability of design and the operating effectiveness of controls throughout a specified period. The two types are not the same sentence. No fixed month count applies to every Type II period.
An attestation report, not a seal
SOC 2 is a CPA attestation report. It is not a government license. The SOC suite main page advises service organizations and CPA firms to evaluate SOC services thoroughly. It treats promises of fast and easy engagements as a credibility risk. The report carries more weight than a homepage shield.
The word SOC in a security operations center is a different term. An on-call function is not this report.
A vendor's claim is not a SOC 2 report for the product. Type, period, and opinion are UNKNOWN until the user entity has the attestation report. Even whether a report exists is UNKNOWN until then. A promotional slide is not the report.
Rewrite the one-line claim
The claim "they are SOC 2 certified, so we are safe, and HIPAA, PCI, and FedRAMP are done" treats a report as a certificate. Exact replacement: "They provided a SOC 2 report for system X, Trust Services Criteria categories Y, Type I or Type II Z, and period P." Carve-outs still get a review. Tenant duties still get a review too.
A vendor can send a SOC 2 claim. The team then privately requests the report or a bridge letter. The team notes the system name, the type, and the period. It also notes one carve-out question for the owner.
SOC 2 is not PCI, HIPAA, FedRAMP, or an ISO certificate
| Folklore | Literacy |
|---|---|
| SOC 2 means PCI is done | PCI DSS is payment-brand and acquirer validation for payment account data. It is a different category. |
| SOC 2 means HIPAA is done | The HIPAA Security Rule is a U.S. health regime for ePHI. It is a different regime. |
| SOC 2 means FedRAMP Authorized | FedRAMP is federal cloud Authorization reuse. It is a different program. |
| SOC 2 means an ISO certificate | ISO/IEC 27001 is a requirements standard for a scoped information security management system. It is a different assurance family. |
| SOC 2 replaces my tenant IAM review | The report can inform vendor risk. The customer still reviews admin roles, OAuth grants, SSO and SCIM, and export and recovery. |
Common misconceptions
SOC 2 is a certificate that replaces PCI, HIPAA, FedRAMP, and ISO.
SOC 2 is an AICPA attestation report for a described system. PCI DSS, the HIPAA Security Rule, FedRAMP, and an ISO certificate are different regimes. A logo does not merge them.
Type I and Type II mean the same thing.
Type I addresses design as of a specified date. Type II addresses design and operating effectiveness over a specified period.
A homepage SOC 2 badge is enough. Scope, period, and carve-outs can wait.
A review covers the system description, the categories in scope, the type, and the period. The review also includes complementary user-entity controls, and carve-outs or subservice organizations. The shield is not the report.
SOC 2 means customers can skip tenant IAM, OAuth, and admin-role review.
A report can inform vendor risk. The customer still owns admin roles, OAuth grants, SSO and SCIM, and export and recovery in the tenant.
Every SOC 2 report covers all five Trust Services Criteria categories.
Security is always in scope. Availability, confidentiality, processing integrity, and privacy appear only when a report includes them.
CHECK THE CATEGORY
When Meridian Space & Robotics reviews a vendor's SOC 2 materials, which statement describes the deliverable accurately?
Glossary and nearby pages
- Technology/SaaS industry path
- Customer configuration and recovery (tenant duties remain)
- PCI DSS explainer (payment account data, different regime)
- HIPAA Security Rule explainer (ePHI, different regime)
- FedRAMP explainer (cloud Authorization, different regime)
- Cloud and SaaS shared responsibility (customer duty)
- SOC (the operations center, not this report)
- ISO/IEC 27001 explainer (scoped ISMS certificate, different assurance family)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.