SOC 2
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the AICPA (American Institute of Certified Public Accountants) that evaluates service organizations' controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports provide assurance to customers and stakeholders that an organization's systems are designed and operating effectively to protect their data. Unlike ISO 27001, SOC 2 is not a certification but an audit report.
Key Components
Trust Services Criteria (TSC)
Five criteria categories: Security (common criteria, required), Availability, Processing Integrity, Confidentiality, and Privacy. Organizations select which criteria beyond Security are applicable to their services.
Common Criteria (Security)
The required security criteria — including control environment, communication, risk assessment, monitoring, control activities, logical access, system operations, and change management.
Type I vs. Type II
Type I reports evaluate control design at a point in time; Type II reports evaluate both design and operating effectiveness over a period (typically 6-12 months). Type II is more rigorous and more valuable to customers.
Control Activities
Specific controls implemented to meet the Trust Services Criteria — documented, tested, and evidenced by the organization and verified by the auditor.
Bridge Letter
A letter provided by the organization between SOC 2 audit periods confirming that no significant changes have occurred — bridging the gap between Type II report periods.
Benefits
- Demonstrates to customers that controls are designed and operating effectively
- Required by many enterprise customers as a condition of doing business
- Reduces the need for individual customer security assessments and questionnaires
- Supports compliance with multiple regulations through control mapping
- Type II reports provide evidence of operating effectiveness over time, not just design
How MPG Helps
MPG's Cyber Governance module supports SOC 2 preparation by mapping controls to Trust Services Criteria, tracking control testing and evidence, managing remediation for control gaps, and maintaining audit trails that demonstrate operating effectiveness. The evidence module organizes SOC 2 evidence, and the compliance obligation register tracks SOC 2 requirements alongside other obligations.
Educational Content
This page provides educational information about SOC 2. MPG does not provide legal or regulatory advice. Always consult qualified professionals and the official framework documentation for specific compliance requirements.