What Is SOC 2 Compliance? A Guide for IT Teams

SOC 2 compliance means a licensed CPA firm has examined a service organization's controls and issued a SOC 2 report on them. The examination is set by the AICPA and measured against its Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy.

Companies get SOC 2 reports because their customers ask for them. If you sell software or run systems that hold customer data, a large customer's security review will often start with "send us your SOC 2 report".

This guide explains what the report is, who needs one, what the criteria ask for, how the audit works, what it costs, and where IT teams carry most of the work: identities and devices. When you are ready to plan the work, our SOC 2 compliance checklist lists 69 controls with the evidence auditors sample.

Download the SOC 2 checklist (PDF + Excel)

TL;DR

What does "SOC 2 compliant" mean?

When a company says it is SOC 2 compliant, it usually means it has a recent SOC 2 report, ideally a Type 2, with a clean (unqualified) opinion. That is the accurate way to say it: "we have a SOC 2 Type 2 report covering January to December."

Is SOC 2 a certification? No, although many people call it one. There is no SOC 2 certificate and no certifying body. A CPA firm performs an attestation and writes a report. The report describes your system, lists your controls, and, for a Type 2, shows how each control was tested and whether exceptions were found. Customers read it, usually under an NDA.

The CPA firm performs the examination under the AICPA attestation standards (sections AT-C 105 and 205). You may also see "SOC 2.0" or "SOC II". They mean the same report. SOC stands for System and Organization Controls; the older name, Service Organization Control, is still common.

Is SOC 2 mandatory? No law requires it. It is a market requirement: enterprise buyers, regulated customers and procurement teams ask for it before they share data with you.

Who needs SOC 2?

Any service organization that stores, processes or transmits customer data and sells to businesses that will ask. In practice:

• SaaS and cloud companies, the most common case.
• Managed service providers and MSSPs, because they hold admin access to their clients' systems.
• Data processors and outsourcers: payroll, payments, analytics, call centers, data centers.
• Any vendor in a regulated customer's supply chain, where the customer's own auditor asks how its vendors are controlled.

If your customers are consumers, or you hold no customer data, you probably don't need one yet.

The Trust Services Criteria

SOC 2 reports use the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022. The 2022 revision added and reworded points of focus, for example on patch management, but did not change the criteria themselves. The criteria are grouped into five categories:

Many first reports cover Security alone, or Security plus Availability and Confidentiality. Add a category only when customers ask for it.

The 33 Security criteria sit in nine series, CC1 to CC9. CC1 to CC5 follow the COSO internal control framework. CC6 to CC9 are extra criteria the AICPA added on top of COSO, and they are where most IT work sits: access, devices, monitoring, change and vendors. The checklist post breaks down every series and the controls that meet it.

Type 1 vs Type 2, and SOC 1 vs SOC 2 vs SOC 3

A Type 1 report tests whether your controls are designed well, as of a single date. A Type 2 report tests whether they operated effectively over a period, usually 3 to 12 months. Enterprise buyers generally want a Type 2. Some companies get a Type 1 first to answer customers sooner. Our comparison of SOC 2 Type 1 vs Type 2 covers the trade-offs.

• SOC 1 covers controls relevant to customers' financial reporting, such as payroll or billing. See SOC 1 vs SOC 2.
• SOC 2 covers security and the other Trust Services categories, in detail, for customers under NDA.
• SOC 3 covers the same ground as SOC 2 in a short public summary, without the test details.

How SOC 2 compliance works, step by step

1. Scope. Decide which system the report covers, which categories, and which report type. Keep the boundary tight: the product customers buy and the people and systems that run it.
2. Gap or readiness assessment. Compare what you do today with the criteria. Our checklist works as a self-assessment.
3. Close the gaps. Write the policies, put the controls in place, and start collecting evidence.
4. Choose a CPA firm. Only a licensed CPA firm can issue a SOC 2 report. Check that it is enrolled in AICPA peer review.
5. The period. For a Type 2, controls run for 3 to 12 months while you collect evidence as it happens.
6. Fieldwork and the report. The auditor samples evidence, tests controls and issues the opinion.

The checklist post explains what happens during the audit in more detail, including sampling and the request list.

How long it takes and what it costs

There are no official figures. Audit firms and compliance vendors publish estimates, and they vary widely with scope, company size and the firm you choose. Typical published ranges:

Your own staff time is often the larger cost. The checklist post keeps one table of vendor estimates with sources, so the numbers stay in one place.

The device side of SOC 2

SOC 2 doesn't name products, and it doesn't require MDM by name. But the criteria ask you to inventory, protect and control the devices that reach customer data, and in a Type 2 the auditor checks that across the whole period. That makes laptops and phones a common source of exceptions.

• The inventory is the population. Auditors sample devices from your list. A laptop missing from it is a laptop nobody can prove was encrypted.
• Every operating system counts. A fleet of Macs, Windows laptops and a few Linux machines needs the same baseline on each.
• Personal devices need a decision. Either keep customer data off them, or require a work profile or managed apps and a passcode, and write that down.
• Collect reports as you go. Monthly encryption and patch reports cover a 12-month period. A screenshot taken on audit day doesn't.

For MSPs: if you manage devices for clients, each client will review you as a vendor under its own vendor-risk controls (CC9.2), and its auditor may ask to see that review. Keep each client's devices, admins and reports separate, so you can answer one client without exposing another. If you rely on an MSSP for EDR or monitoring, ask for its SOC 2 report, because your auditor will look at how you rely on it.

Get the SOC 2 checklist with 69 controls

Keeping SOC 2 compliance after the first report

SOC 2 reports don't expire, but buyers expect a recent one. Buyers usually expect a new report every year, with periods that follow each other without a gap. Between reports, customers may ask for a bridge letter: a letter signed by your management, not the auditor, saying whether controls changed since the last period ended.

Treat SOC 2 as a set of routines, not a project: quarterly access reviews, monthly device reports, a yearly risk assessment and vendor review, and offboarding that removes access the same day.

Common SOC 2 challenges, and how to avoid them

• Template policies you don't follow. The auditor tests what the policy says. Cut what you won't do.
• Offboarding that stops at single sign-on. Apps outside your identity provider keep former staff signed in.
• Devices missing from the inventory, or encrypted only on paper.
• Reviews that slip. A quarterly access review done in month five is an exception.
• Treating a compliance tool as the control. Tools collect evidence. Your team still runs the controls.

If you are also weighing ISO 27001, many controls overlap. Our ISO 27001 vs SOC 2 comparison explains the differences, and SOC 2 for small businesses covers the risks of going without a report.

How trio.so helps with the device controls

SOC 2 stays your program: the policies, reviews, vendors and the audit are yours. trio.so manages many of the device controls above from one console:

• Hardware and software inventory for every enrolled device.
• BitLocker and FileVault enforcement, with encryption status for each Windows and Mac device.
• Passcode and screen-lock rules, and OS update enforcement on Windows, macOS, iOS and Android.
• Lock lost Macs, iPhones and Android devices, and wipe company-owned devices remotely.
• An admin event log of who changed what and when, plus SSO and MFA for the console.
• Compliance evidence you can export for your auditor, instead of collecting screenshots by hand.

See also our guide to SOC 2 compliance automation and compliance automation in trio.so.

Start free trial Book a demo

14-day free trial. No credit card required.

Sources. Last reviewed October 2026. Time and cost figures are estimates from audit firms and vendors, not AICPA rules.

• AICPA, SOC 2: SOC for Service Organizations
• AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022)
• AICPA, SOC 2 Guide (October 2022)