SOC 2

An audit of how well a vendor protects your data.

An independent accountant examines a company's security and privacy practices and writes a report that customers can read to judge how well the company protects their information.

An independent auditor's report, based on criteria from the American Institute of Certified Public Accountants (AICPA), on a vendor's controls for security, availability, confidentiality, processing integrity, and privacy. A control is a safeguard or process, such as access restrictions or incident response, that a company uses to protect data.

The five areas are called the Trust Services Criteria:

• Security, which protects systems and data against unauthorized access. Every SOC 2 report covers it.
• Availability, which covers whether systems are up and usable as promised.
• Processing integrity, which covers whether processing is complete, accurate, and timely.
• Confidentiality, which covers protection of information designated as confidential.
• Privacy, which covers how personal information is collected, used, and disposed of.

A company chooses which of the optional criteria to include. There are two types of report:

1. Type I describes the controls and assesses whether they were designed appropriately at one point in time.
2. Type II also tests whether the controls actually worked over a period of time, usually several months to a year.

SOC 2 sits next to terms that are easy to mix up:

• Audit trail is a record of actions and decisions, which an auditor may examine as evidence.
• PCI DSS is a security standard for payment card data, enforced by the card networks, while SOC 2 is an audit report.
• Data residency is where data is stored, which is a separate question from how well it is protected.