Glossary
SOC 2
Also called: Service Organization Control 2, SOC 2 report
In one sentence
An independent audit report, based on AICPA criteria, that shows how a service company protects the data it handles for its clients.
SOC 2 is a reporting framework created by the AICPA (the American Institute of Certified Public Accountants). A service company hires an independent CPA firm to examine its controls against the Trust Services Criteria: security (always included), plus optionally availability, processing integrity, confidentiality and privacy. The result is a SOC 2 report the company can share with clients under NDA.
There are two types. A Type I report looks at whether controls are designed properly at a single point in time. A Type II report tests whether those controls actually operated effectively over a period, typically several months to a year. Larger clients usually want Type II.
You can’t be “SOC 2 certified” — it’s an attestation report, not a certificate. Many small firms never need a full audit; what they need is to be SOC 2–aligned: controls like MFA, managed and encrypted devices, access reviews, logging and written policies that hold up when a big client sends a security questionnaire.
Example: in our accounting firm case study, larger clients were asking tough vendor-risk questions. The firm built a SOC 2–aligned environment — managed devices, strong sign-in, documented controls — and passed its client security reviews with no findings to fix. If clients are asking you similar questions, our compliance readiness service is built for that.
Related terms
- WISP (written information security plan)A written document describing how your business protects sensitive customer information — required for tax and accounting professionals under federal rules.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- Least privilegeLeast privilege means giving every person, account and program only the access it needs to do its job — nothing more, and for no longer than necessary.
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- SIEM (security information and event management)A SIEM is a system that collects logs from across your environment in one place, keeps them, and analyzes them to spot and investigate security problems.