Glossary
SOC report
A SOC report is an independent auditor's report on the controls a service organization uses to protect the systems and data it handles for customers. The SOC 2 Type II variant tests whether those controls operated effectively over a period of months. Its assurance extends only as far as the scope the report defines.
SOC 1, SOC 2 and SOC 3
SOC stands for System and Organization Controls, a reporting framework from the AICPA, the American professional body for certified public accountants. The three report types serve different readers.
| Report | What it covers | Who reads it |
|---|---|---|
| SOC 1 | Controls relevant to customers' financial reporting | Customer finance teams and their auditors |
| SOC 2 | Security and operational controls, assessed against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy | Customer security, risk and procurement teams, usually under a confidentiality agreement |
| SOC 3 | A short general-use summary of a SOC 2 engagement, without test details | Anyone; often published on a provider's website |
For storage and cloud services, the SOC 2 is usually the document requested. Security is always included, while the other criteria appear only when the provider chooses to add them, so a report may say nothing about availability at all.
Type I and Type II
A Type I report assesses whether controls were suitably designed as of a single date. A Type II report also tests whether they operated effectively across a period, typically several months to a year. A Type I shows a control existed on the day the auditor looked; a Type II shows it kept working, which is what a customer actually depends on.
How is a SOC 2 report read?
- Confirm the type and period. A Type II whose period ended long ago leaves a gap, which a bridge letter from the provider may partly cover.
- Check the scope. Reports often cover one service, product or region rather than the whole company, and the service being bought has to be inside it. In hybrid cloud environments, scope is often split across several reports from different providers.
- Read the exceptions. Failed tests appear in the detailed results even when the overall opinion is clean.
- Look for carved-out subservice providers. When a provider relies on a hosting company that is carved out, that layer is not tested in the report at all.
- List the complementary user entity controls. These are controls the report assumes the customer performs, such as managing its own user access. If the customer does not perform them, the assurance does not hold.
What a clean report does not establish
A SOC 2 attests that the described controls worked. It does not establish particular technical properties: that backups are immutable, that data stays in a given country, or how encryption keys are held. Those are settled by configuration and contract, such as whether retention locks are enabled among the cloud storage security controls and where data residency commitments are written down. On a shared platform, the report tests how tenant isolation is enforced only if isolation is among the described controls. A SOC report is one input to third-party risk review, alongside certifications, questionnaires and technical assessment.
Frequently asked questions
Who issues a SOC report?
A licensed CPA firm that is independent of the provider. The provider commissions and pays for the audit, but the opinion is the auditor's.
Is SOC 2 the same as ISO 27001?
No. ISO 27001 certifies an information security management system against an international standard. SOC 2 is an attestation report with detailed test results under the AICPA framework. Many providers hold both.
What is a qualified opinion in a SOC report?
It means the auditor found a problem serious enough that the controls, or their description, cannot be relied on in that area. Lesser problems appear as exceptions in the test results.