What SOC 2 is
SOC 2 is an attestation report on a service organisation’s controls, defined by the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines your controls and writes an opinion on them. Customers ask for it because it lets them rely on an independent check instead of auditing you themselves.
There is no pass or fail certificate. You receive a report, and the auditor’s opinion in it says whether your controls are suitably designed (and, for Type II, whether they operated effectively).
The Trust Services Criteria
The report is built on the Trust Services Criteria. Security is always in scope; the other four are optional and chosen by what you promise customers.
| Criteria | Covers | Include it when |
|---|---|---|
| Security (Common Criteria) | Protection against unauthorised access | Always |
| Availability | Uptime and recovery | You commit to uptime or recovery times |
| Confidentiality | Data marked confidential | You hold customers’ confidential information |
| Processing integrity | Complete, accurate, timely processing | Your service processes transactions or calculations |
| Privacy | Personal information over its life cycle | You collect personal data directly from individuals |
Type I versus Type II
| Type I | Type II | |
|---|---|---|
| Question it answers | Are the controls designed properly on one date? | Did the controls work over a period of time? |
| Period | A single point in time | An observation window, commonly 3 to 12 months |
| Typical use | A first report to unblock deals quickly | What most enterprise customers ultimately ask for |
Many companies start with Type I and move to Type II, or go straight to a Type II with a shorter first window.
How to get there
- Scope. Decide which systems, people and criteria are in scope.
- Gap assessment. Compare what you do today with the criteria.
- Remediate. Write policies, put controls in place, assign owners.
- Collect evidence. Screenshots, exports, tickets and sign-offs that prove each control.
- Pick an auditor. A licensed CPA firm; ask about their experience with companies your size.
- Audit. Type I on a date, or Type II across the observation window.
- Stay ready. Controls must keep operating; the next report covers the next period.
Where teams get stuck
- Evidence collected once and then left to go stale.
- Access reviews that happen but are never recorded.
- Vendors with no assessment or agreement on file.
- Policies that exist but were never acknowledged by staff.
- Change management with no recorded approval.
How Doniastack helps
Doniastack tracks each control against the criteria, keeps evidence with its collection date and owner, and gives your auditor a workspace. Our specialists run the gap assessment and work through remediation with you. Start with the SOC 2 readiness checklist.
Get started
See where you stand in 30 minutes
Tell us which review or audit is in front of you. We'll walk you through the platform and map what readiness takes, with no obligation.