# SOC 2 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_soc2-soc-2-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [SOC2 Readiness](https://support.icompaas.com/support/solutions/62000111733) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_62000111733_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

SOC 2 · AICPA TSP §100, 2017 (with 2022 points-of-focus update)

### What is it?

**SOC 2** is an _attestation report_ issued by a licensed CPA firm against the **AICPA Trust Services Criteria** (Security, Availability, Processing Integrity, Confidentiality, Privacy). Unlike ISO 27001 it isn't a global "yes/no" certificate — it's an opinion letter that customers and their auditors read end-to-end.

### Type I vs Type II

-   **Type I** — controls are _designed_ appropriately at a point in time. Quick to obtain (3–6 weeks once ready).
-   **Type II** — controls _operated effectively_ across an audit window, typically 6–12 months. This is what most B2B customers actually require.

### The Trust Services Criteria

Security (the "Common Criteria", CC1–CC9) is mandatory. The other four are optional categories you add based on what you sell:

-   **Availability** — for any service whose downtime hurts customers.
-   **Processing Integrity** — for systems that process financial / clinical / pricing data.
-   **Confidentiality** — when you handle customer-confidential data under NDA.
-   **Privacy** — when you handle personal information; aligns with GAPP.

### Audit shape

You pick the criteria, pick the audit window, evidence the controls over that window, and the CPA firm samples and opines. The deliverable is a long PDF — your customers will read sections II–IV (the controls + tests + results) before they sign.

### The two failure modes

(1) **Unqualified opinion with a long list of exceptions** — common when readiness work was rushed; sales conversations get harder. (2) **Scope creep** — including Availability/PI/Confidentiality/Privacy "for completeness" can balloon the audit; pick what your contracts actually require.

### How iCompaas helps

iCompaas pre-builds the Common-Criteria control library mapped to AWS/Azure/GCP/Workspace/GitHub evidence sources, runs the technical controls continuously (so a Type II window doesn't need a frantic backfill), and exports the evidence pack auditors expect (control matrix, sample evidence per control, change tickets, incident tickets).

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): The full SOC 2 implementation guide: scoping the Trust Services Criteria, the roadmap to a Type 2 report, and what the auditor samples.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Teams that finish SOC 2 usually add ISO 27001 next; the control overlap is large and the guide explains what is genuinely extra.