SOC 2

SOC 2 is an independent audit report that assesses how a service provider protects customer data, based on criteria developed by the American Institute of Certified Public Accountants.

SOC 2 reports are based on the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report describes a provider's controls at a single point in time, while a Type II report tests whether those controls actually operated effectively over a period, commonly several months to a year. Despite the similar name, it is unrelated to a security operations centre.

When your business relies on cloud software, payroll services or IT providers, you are trusting them with your data and often your clients' data too. Under PIPA, you remain responsible for personal information handled on your behalf. A SOC 2 report gives you independent evidence about a vendor's security practices rather than relying on marketing claims.

Practical tip: when choosing a critical vendor, ask for its most recent SOC 2 Type II report. Check the date, the scope, any exceptions the auditor found and the complementary controls the vendor expects you to have in place on your side.