{"head":{"title":"What Is a SOC 2 Type II Report? Definition | OceanLab","description":"SOC 2 Type II is an independent audit report on whether a provider's controls worked over a period. Type I vs Type II, what it covers, and common mistakes.","canonical":"https://oceanlab.in/glossary/soc-2-type-ii"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"SOC 2 Type II","path":"/glossary/soc-2-type-ii"}],"slug":"soc-2-type-ii","term":"SOC 2 Type II","aka":["SOC 2 Type 2"],"category":"Compliance","short":"An independent audit report on whether a service organisation's controls were designed well and worked over a period of time.","body":[["SOC 2 is an attestation framework from the AICPA. An independent CPA firm examines a service organisation's controls against the Trust Services Criteria: security, which is always included, plus availability, processing integrity, confidentiality and privacy if chosen."],["A Type I report looks at whether controls are designed well at a single date. A Type II report also tests whether they operated effectively over a review period, often several months, so it carries more weight with customers."]],"why":["Business customers often ask vendors for a SOC 2 Type II report in security reviews before they sign. For a software team it turns into concrete work: access reviews, change management with approvals, logging and monitoring, backups, incident response and vendor management, all with evidence kept over time."],"example":["A B2B analytics startup loses a deal because the buyer's security team requires a SOC 2 report. It sets up the controls, runs a Type I first, then collects evidence over a review period for its first Type II report."],"inBuild":null,"mistakes":[["Saying SOC 2 certified. It is an attestation report, not a certification."],["Treating it as a one-off project. Type II tests that controls kept working."],["Asking a vendor for their report and never reading the exceptions and carve-outs in it."]],"related":[{"href":"/glossary/maker-checker","label":"Maker-checker (four-eyes principle)","detail":"A control where one person makes a change and a different person must approve it before it takes effect."},{"href":"/glossary/baa","label":"BAA (business associate agreement)","detail":"The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI."},{"href":"/glossary/cardholder-data-environment","label":"Cardholder data environment (CDE)","detail":"The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them."},{"href":"/glossary/phi","label":"PHI (protected health information)","detail":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate."}],"tools":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/compliance/soc-2","label":"SOC 2 guide","detail":"The controls behind a SOC 2 report."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[{"title":"AICPA & CIMA, SOC suite of services","url":"https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}