SOC 2
- Name
- SOC 2
- Publisher
- AICPA
- Type
- Assurance report
- What it is
An independent report on a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy. Type 1 covers design at a point in time; Type 2 covers operating effectiveness over a period.
- Key points
- Type 1: design at a point in time
- Type 2: operating effectiveness over a period
- Watch carve-outs, exceptions and complementary user entity controls
- On the exam
Vendor assurance: coverage period, bridge letters, carve-outs and complementary user entity controls.