SOC 2 Standards – Service Organization Control 2

SOC 2 (Service Organization Control 2) is a framework for assessing the internal controls of service organizations that handle customer data. It was developed in 2010 by the American Institute of Certified Public Accountants (AICPA) and defines criteria for how organizations should process data securely and reliably.

Unlike strictly prescriptive standards such as PCI DSS, SOC 2 is not a rigid checklist. Instead, each organization designs its own controls, which are then examined by an independent CPA auditor. The goal is to build trust by enabling customers, partners, and regulators to understand how a provider ensures the availability, integrity, and confidentiality of sensitive data.

Why is SOC 2 relevant?

• Customer trust: Especially for cloud service providers and SaaS companies, SOC 2 is a key sales argument
• Market requirement: Many U.S.-based customers demand SOC 2 reports as proof of security competence
• Flexibility: Unlike rigid certifications, companies can tailor controls to their specific services

---

Core Concepts and Requirements

Trust Services Criteria (TSC)

SOC 2 is based on five Trust Services Criteria (TSC). The security criteria are mandatory; the other four can be included in the audit scope depending on the service. Each category includes Points of Focus that an organization must meet or justify.

The Five Trust Services Criteria in Detail

1. Security (Common Criteria) – Mandatory

• Purpose: Protect information from unauthorized access and misuse
• Key aspects:
  • Access controls and permissions management
  • Authentication methods (e.g., multi-factor authentication)
  • Network firewalls and intrusion detection systems
  • Physical security measures
  • Protection against malware and other threats

2. Availability – Optional

• Purpose: Ensure systems and services are available to employees and customers
• Key aspects:
  • Fault-tolerant design and redundancies
  • Disaster recovery plans and business continuity management
  • Performance and network monitoring
  • Service-level agreements (SLAs)
  • Capacity planning and scalability

3. Processing Integrity – Optional

• Purpose: Demonstrate that systems perform their functions correctly, completely, and on time
• Key aspects:
  • Clear specification and monitoring of inputs, processing, and outputs
  • Protection against unintentional manipulation
  • Data validation and error handling
  • Transaction integrity
  • Quality assurance processes

4. Confidentiality – Optional

• Purpose: Protect confidential information through restricted access, storage, and use
• Key aspects:
  • Encryption in transit and at rest (TLS, AES)
  • Principle of least privilege
  • Non-disclosure agreements (NDAs)
  • Secure data disposal
  • Information classification

5. Privacy – Optional

• Purpose: Govern the collection, use, storage, and disposal of personal data according to the Generally Accepted Privacy Principles (GAPP)
• Key aspects:
  • Definition of what constitutes personal information
  • Implementation of controls to protect such data
  • Consent management
  • Data subject rights (access, deletion, rectification)
  • Privacy policies and procedures

Practical tip: Most companies start with the Security criteria and add further TSCs based on customer requirements. Cloud providers often include “Availability” and “Confidentiality.”

Types of SOC 2 Reports

SOC 2 offers two report types that differ in scope and level of assurance:

Type I Report – Design of Controls

• Scope: Evaluates whether control design is suitable at a specific point in time
• Time frame: Snapshot (as-of date)
• Best for: Organizations just building a control environment
• Advantage: Faster to obtain (3–6 months of preparation)
• Drawback: Lower assurance for customers

Type II Report – Design and Operating Effectiveness

• Scope: Additionally examines the effectiveness of controls over a defined period
• Time frame: Typically 3–12 months (commonly 6 or 12 months)
• Best for: Established organizations with functioning controls
• Advantage: Gold standard – highest level of assurance for customers
• Drawback: Longer preparation time and higher cost

Differences from Other SOC Reports

SOC 1

• Focus: Service organizations whose controls impact their customers’ financial reporting
• Examples: Payroll providers, payment processors, accounting services
• Standard: SSAE 18 (U.S.) / ISAE 3402 (International)

SOC 3

• Focus: Public report based on a SOC 2 examination
• Special feature: No detailed test descriptions – for marketing and public communication
• Use: Website seals, sales collateral, general trust building

---

Distinction from ISO 27001

SOC 2 and ISO 27001 overlap by roughly 80% in their requirements. Both frameworks require an external assessment and address principles such as security, integrity, and availability of information.

Key Differences

Aspect	SOC 2	ISO 27001
Target market	U.S.-centric standard	Internationally recognized
Flexibility	Choose from 5 TSCs; design your own controls	93 mandatory controls in Annex A
Report form	Attestation report by a CPA	Certificate from an accredited body
Validity	Renewed annually	3 years with annual surveillance audits
Cost	Generally lower	Higher initial costs
Documentation	System Description	ISMS documentation

Leveraging Synergies

Many organizations combine SOC 2 and ISO 27001:

• Shared controls: About 80% overlap in requirements
• Combined audits: Some auditors offer integrated assessments
• Global coverage: ISO 27001 for international markets, SOC 2 for U.S. customers
• Efficiency gains: An ISO 27001 ISMS greatly streamlines SOC 2 preparation

---

Implementation Aids and Practice

Project Preparation and Scoping

1. Scoping and TSC Selection

• Define scope: Which services, systems, and locations will be examined?
• Select TSCs: Security is mandatory – which additional criteria do your customers require?
• Include supporting systems: Ticketing tools, change management, incident tracking
• Document exclusions: Clearly justify why certain areas are out of scope

2. Decide on Type I or Type II

• Start with Type I: If you don’t yet have established controls
• Go straight to Type II: If controls and processes already exist (e.g., via ISO 27001)
• Customer expectations: Many customers only accept Type II reports

3. Perform a Gap Analysis

Self-assessment in four steps:

1. Capture the current state: Which controls already exist?
2. Define the target state: What do the selected TSCs require?
3. Identify gaps: Where are controls or evidence missing?
4. Create a remediation plan: Prioritize by risk and effort

Practical tip: Use the AICPA Trust Services Criteria as a checklist. The Points of Focus provide concrete examples of effective controls.

4. Close the Gaps

Typical actions:

• Create policies: Information security policy, access control, incident response
• Technical controls: Enable MFA, implement encryption, set up logging
• Document processes: Change management, vulnerability management, backup & recovery
• Training: Security awareness, data protection, clean desk policy
• Adjust contracts: Supplier agreements, NDAs, data processing agreements

5. Readiness Assessment

Before the official audit:

• Internal audits: Test the effectiveness of your controls
• Mock audit: Have an external advisor perform a dry run
• Collect evidence: Screenshots, logs, reports, procedural documentation
• Management review: Involve leadership in preparation

Best Practices for a Successful SOC 2 Audit

Organizational Success Factors

1. Clarify responsibilities

• Appoint an experienced project lead (e.g., CISO, Compliance Manager)
• Define clear roles and responsibilities
• Establish regular status meetings

2. Engage stakeholders

• Executive leadership: Secure budget and resources
• IT: Implement technical controls
• DevOps: Secure the CI/CD pipeline, code reviews
• Legal: Contracts and data protection
• HR: Staff training and background checks

3. Know your risks and weaknesses

• Document data flows and storage locations
• Run regular vulnerability scans
• Report security incidents transparently
• Implement a risk management system

Technical and Process Recommendations

Critical controls for SOC 2:

• Access control: Role-based access control (RBAC), regular access reviews
• Encryption: TLS 1.2+ in transit, AES-256 at rest
• Monitoring: SIEM, log aggregation, alerting
• Backup & recovery: 3-2-1 rule, regular recovery tests
• Patch management: Monthly updates, critical patches within 30 days
• Incident response: Documented process, escalation path, post-mortems

Documentation and Evidence:

• Version control: Version all policies and procedures
• Audit trails: Comprehensive logging of changes
• Evidence management: Central repository for audit evidence
• Metrics: KPIs for availability, incident response times, patch levels

Practical tip: Implement a compliance management tool to centrally manage SOC 2 documentation and evidence. This greatly simplifies audit preparation and reduces manual effort.

Choosing the Right Auditor

Selection criteria:

• CPA license: Only licensed CPAs can issue SOC 2 reports
• Industry experience: Familiarity with your industry and technology
• References: Successful SOC 2 audits for similar companies
• Advisory approach: Balance between rigor and pragmatic solutions
• Costs: Type I: USD 10,000–30,000; Type II: USD 20,000–60,000 (depending on scope)

---

Integration with Other Frameworks

SOC 2 can be effectively combined with other security standards:

Combination Options

ISO 27001 + SOC 2

• Use the ISMS as the foundation for SOC 2 controls
• Combined audits possible with qualified auditors
• Roughly 80% requirement overlap

NIST CSF + SOC 2

• Use the NIST Cybersecurity Framework to structure controls
• Map NIST functions to TSCs
• Particularly relevant for U.S. government contracts

HIPAA + SOC 2

• For healthcare providers and business associates
• SOC 2 + HIPAA criteria in a single report is possible
• Demonstrates compliance for health data

GDPR + SOC 2

• Privacy TSC covers many GDPR requirements
• Document technical and organizational measures (TOMs)
• Data processing agreements as part of the examination

---

Support from the fuentis Suite

The fuentis Suite provides comprehensive support for the SOC 2 process and can significantly increase the efficiency of your compliance efforts:

Risk Management Module

• Risk identification: Systematic capture of all relevant risks for the selected TSCs
• Risk assessment: Prioritization by likelihood and impact
• Remediation planning: Link risks to controls and actions
• Automated reviews: Reminders for regular risk assessments
• Audit trail: Complete documentation of all changes

Asset Management

• Central inventory: Record all IT assets and information assets
• Classification: Categorize by protection needs and criticality
• Responsibilities: Clear assignment of asset owners
• Lifecycle management: From procurement to secure disposal

Compliance Management

• SOC 2 templates: Predefined templates for all five TSCs
• Control checklists: Points of Focus as auditable checklists
• System Description: Structured capture of your system environment
• Evidence register: Central management of all audit evidence
• Gap analysis: Automated comparison of current vs. target state

Audit Modules

• Audit planning: Annual plan for internal audits
• Execution: Digital checklists and evaluations
• Nonconformities: Recording and tracking of findings
• Corrective actions: Workflow for implementation and effectiveness checks
• Reporting: Automated audit reports

Document Management

• Version control: Versioned policies and procedures
• Approval workflows: Digital approval processes
• Distribution: Automatic notifications for updates
• Read receipts: Proof of acknowledgment
• Audit trails: Full history of all document changes

Monitoring & Reporting

• Dashboards: Real-time overview of compliance status
• KPI tracking: Availability, response times, patch levels
• Trend analyses: Security posture over time
• Management reports: Executive-ready summaries
• Auditor access: Read-only access for external auditors

---

Key Takeaways at a Glance

1. Flexible framework: SOC 2 is based on five Trust Services Criteria, with only the Security criterion mandatory. Companies select additional criteria based on customer needs and design their own controls.
2. Type II as the gold standard: While Type I reports assess control design, Type II also tests operating effectiveness over time. A Type II report provides significantly greater assurance and is considered the industry standard.
3. Structured preparation is crucial: Careful scope definition, systematic gap analysis, and targeted remediation are the foundation of a successful audit. Plan 6–12 months for preparation.
4. Documentation and evidence are critical: Documented policies, implemented technical safeguards, and comprehensive evidence (logs, screenshots, reports) greatly facilitate the audit and strengthen security culture.
5. Leverage synergies with ISO 27001: SOC 2 and ISO 27001 overlap by about 80%. By combining them effectively, organizations can reduce effort and serve both international and U.S. customers at the same time.