Compliance & Assurance
SOC 2
SOC 2 (System and Organization Controls) Trust Services Criteria
By Clear Infosec · Last reviewed: August 2026
SOC 2 is an attestation report, performed by a licensed CPA firm, on how a service organization's controls meet the AICPA Trust Services Criteria.
What is SOC 2?
SOC 2 reports evaluate controls relevant to Security (the required common criteria) and optionally Availability, Processing Integrity, Confidentiality, and Privacy.
A Type I report assesses control design at a point in time; a Type II report tests operating effectiveness over a period (commonly 3 to 12 months). SOC 2 is an attestation, not a certification.
Who does SOC 2 apply to?
Service organizations, especially SaaS and technology providers, that store or process customer data and are asked by customers to demonstrate control maturity.
Key security expectations
- Controls mapped to the selected Trust Services Criteria.
- Governance, risk assessment, and vendor management processes.
- Logical and physical access controls, change management, and monitoring.
- Incident response and system operations controls.
- Evidence that controls operated over the review period (for Type II).
How an assessment works
- 1 Select the Trust Services Criteria in scope.
- 2 Readiness and gap assessment against the criteria.
- 3 Remediate gaps and design or strengthen controls.
- 4 Operate controls and collect evidence over the audit period.
- 5 Independent CPA firm performs the SOC 2 examination and issues the report.
Typical evidence
Testing and SOC 2: SOC 2 does not prescribe a specific test, but auditors commonly expect vulnerability management and penetration testing as evidence for monitoring and risk-mitigation criteria (for example CC4 and CC7).
How Clear Infosec helps with SOC 2
Related Clear Infosec services that support SOC 2:
Risk Assessment & Compliance Readiness
Know your risk. Be audit-ready.
Hardening & Control Design Support
Reduce attack surface with strong baselines.
Policy & Procedure Development
Policies that fit your business and pass audit.
IT GRC, TPRM & Audit Preparation
Govern risk, vendors, and audits in one place.
Vulnerability Assessment & Penetration Testing
Find and prove real risk before attackers do.
Frequently asked questions
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by a licensed CPA firm. There is no SOC 2 certificate; there is a report on your controls.
What is the difference between SOC 2 Type I and Type II?
Type I assesses whether controls are suitably designed at a point in time. Type II also tests whether they operated effectively over a period, typically three to twelve months.
Does SOC 2 require a penetration test?
It is not explicitly required, but penetration testing and vulnerability management are widely used as evidence for the security and monitoring criteria.
This page is general information, not legal or regulatory advice. Requirements are defined by the authoritative body linked above.
Preparing for SOC 2?
Talk to Clear Infosec about a readiness assessment, gap analysis, or testing aligned to SOC 2.
Contact us