SOC 2

SOC 2 is the audit report the American market uses to decide whether to trust a service provider: an independent accountant's opinion on whether the company's security, availability and privacy controls actually work. No certification for its own sake — it is a passport: without it, most US enterprise sales simply do not proceed.

What It Is

SOC 2 (Service Organization Control 2) is an attestation framework administered under the AICPA: an independent auditor examines a service organisation's controls against the Trust Services Criteria — security (mandatory), plus availability, processing integrity, confidentiality and privacy (scoped as relevant) — over an observation window, and issues a report. Type I reports the design of controls at a point in time; Type II, far more weighty, tests their operating effectiveness over months. The report itself is restricted-distribution (shared under NDA), with bridges — mapping summaries — published for the curious. It is a US framework by origin but functions as a de facto global SaaS trust signal.

Why It Matters to You

For buyers, SOC 2 is the baseline diligence instrument for SaaS and any service holding your data: ask for the Type II report, check the scope (which systems, which criteria), read the exceptions — every report has some; the question is materiality and remediation — and note the observation window (a report is a photograph, and stale photographs are how surprises happen). For providers, it is market access: the first real question in most US enterprise procurement. Its neighbours matter regionally: ISO 27001 (see separate entry) plays the equivalent role in Europe, Asia and much of the enterprise mainstream, and Singapore's own ecosystem adds IMDA/AIC trust marks for health data.

When You'll Meet It

In vendor due diligence and enterprise sales processes. For any SaaS holding regulated or personal data: current Type II, exceptions read, scope verified — in that order.