What is it?
SOC 2 is an attestation report issued by a licensed CPA firm against the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Unlike ISO 27001 it isn't a global "yes/no" certificate — it's an opinion letter that customers and their auditors read end-to-end.
Type I vs Type II
- Type I — controls are designed appropriately at a point in time. Quick to obtain (3–6 weeks once ready).
- Type II — controls operated effectively across an audit window, typically 6–12 months. This is what most B2B customers actually require.
The Trust Services Criteria
Security (the "Common Criteria", CC1–CC9) is mandatory. The other four are optional categories you add based on what you sell:
- Availability — for any service whose downtime hurts customers.
- Processing Integrity — for systems that process financial / clinical / pricing data.
- Confidentiality — when you handle customer-confidential data under NDA.
- Privacy — when you handle personal information; aligns with GAPP.
Audit shape
You pick the criteria, pick the audit window, evidence the controls over that window, and the CPA firm samples and opines. The deliverable is a long PDF — your customers will read sections II–IV (the controls + tests + results) before they sign.
The two failure modes
(1) Unqualified opinion with a long list of exceptions — common when readiness work was rushed; sales conversations get harder. (2) Scope creep — including Availability/PI/Confidentiality/Privacy "for completeness" can balloon the audit; pick what your contracts actually require.
How iCompaas helps
iCompaas pre-builds the Common-Criteria control library mapped to AWS/Azure/GCP/Workspace/GitHub evidence sources, runs the technical controls continuously (so a Type II window doesn't need a frantic backfill), and exports the evidence pack auditors expect (control matrix, sample evidence per control, change tickets, incident tickets).