Service Organisation Trust Controls (SOC 2)

SOC 2 is an independent assurance report assessing a service organisation's controls against the Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy. Its difference from SOC 1 is focus: SOC 1 addresses financial reporting, SOC 2 addresses information security and service reliability. It is again an auditor's report, not a certificate.

• SaaS and cloud service providers
• Data centre and infrastructure service providers
• Technology companies within scope of an enterprise customer's security assessment
• Software firms selling services into the North American market

Not mandatory; it is obtained at an enterprise customer's request. In the North American market, a SOC 2 Type II report has become almost a standard requirement in the sales process; in Europe, an ISO/IEC 27001 certificate is more commonly requested.

• Security — the mandatory common criterion in every SOC 2 report
• Availability — optional
• Processing Integrity — optional
• Confidentiality — optional
• Privacy — optional
• Common criteria based on the COSO framework (the CC series): control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management, risk mitigation
• The system description and scope boundaries
• The Type I / Type II distinction
• Treatment of subservice organisations
• Complementary user entity controls

1. 1Determining Scope and ProgrammeThe sites and processes to be audited, and the audit duration the scheme requires, are determined.
2. 2Pre-assessmentA gap analysis is optionally carried out; gaps become visible before the main audit.
3. 3On-site AuditRecords review, site observation and worker interviews are carried out against the scheme's checklist.
4. 4Reporting of FindingsFindings are reported according to the scheme's classification. The output of these schemes is an audit report, not a certificate.
5. 5Corrective Action and Follow-upA corrective action plan is submitted for the findings; it is closed with a follow-up audit under the scheme.

The validity period of audit reports is set by the scheme and is mostly between one and two years. The report is used for the period the buying brand accepts.

• Organisation and site details
• Headcount and shift pattern
• Legal permits and licences
• Relevant policies and procedures
• Payroll, time and personnel records

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The number of sites to be audited and the headcount
• The audit duration the scheme prescribes
• Whether a pre-assessment (gap analysis) is requested
• Whether a follow-up audit is required

Most of these schemes produce audit reports, not documents, and are subject to the scheme owner's (e.g. Sedex, amfori, RBA) own approval system; Accreditation in the classical sense is not found in every scheme. Auditor competence and report validity are determined by the scheme owner's rules.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• SOC 1Financial Reporting Controls
• PCI DSSPayment Card Data Security
• TISAXAutomotive Information Security Assessment
• ISO/IEC 27001Information Security Management
• ISO/IEC 27017Cloud Security
• ISO/IEC 27018Personal Data in the Cloud
• ISO/IEC 27701Privacy Information Management
• ISO/IEC 42001Artificial Intelligence Management System