System and Organization Controls 2 Type II (SOC 2).

SOC 2 is one of three AICPA System and Organization Controls reporting frameworks. SOC 1 covers controls relevant to user-entity internal control over financial reporting (the successor to SAS 70). SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality, and privacy under the Trust Services Criteria published in TSP Section 100. SOC 3 is a general-use summary version of SOC 2 designed for public distribution. SOC 2 examinations are performed under AICPA professional standard AT-C 205, Examination Engagements.

The Trust Services Criteria include five categories: Security (the common criteria, always included), Availability, Processing Integrity, Confidentiality, and Privacy. The Security common criteria include 33 specific criteria organized into nine sections (control environment, communication and information, risk assessment, monitoring activities, control activities, logical and physical access controls, system operations, change management, and risk mitigation). Each additional category adds incremental criteria. Most enterprise procurement requirements specify Security alone or Security plus Availability and Confidentiality; Processing Integrity is typical for transaction-processing services; Privacy is often replaced by separate ISO 27701 or HIPAA-specific attestation.

Type I and Type II differ in scope. A Type I report is an attestation on the suitability of the design of controls at a point in time. A Type II report attests to both design and operating effectiveness over an examination period, with sampling and testing of control operation over the period. Type II is the procurement-standard report in US enterprise SaaS and managed-service contracts. Initial issuance typically follows a six-month observation period; subsequent issuance is annual on a rolling twelve-month basis with no gap. Bridge letters cover the period between report end date and the next report start date.