SOC 2 Type II
Also called SOC 2 Type 2.
An independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
Last updated
What it is.
SOC 2 is an attestation framework from the AICPA. An independent CPA firm examines a service organisation's controls against the Trust Services Criteria: security, which is always included, plus availability, processing integrity, confidentiality and privacy if chosen.
A Type I report looks at whether controls are designed well at a single date. A Type II report also tests whether they operated effectively over a review period, often several months, so it carries more weight with customers.
Why it matters
Business customers often ask vendors for a SOC 2 Type II report in security reviews before they sign. For a software team it turns into concrete work: access reviews, change management with approvals, logging and monitoring, backups, incident response and vendor management, all with evidence kept over time.
Common mistakes.
- 01
Saying SOC 2 certified. It is an attestation report, not a certification.
- 02
Treating it as a one-off project. Type II tests that controls kept working.
- 03
Asking a vendor for their report and never reading the exceptions and carve-outs in it.
Read the official text.
Primary sources this definition is based on.
- AICPA & CIMA, SOC suite of serviceschecked 2026-10-25
Work it out with a tool.
Related terms.
- Maker-checker (four-eyes principle)A control where one person makes a change and a different person must approve it before it takes effect.
- BAA (business associate agreement)The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.
- Cardholder data environment (CDE)The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
- PHI (protected health information)Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
Guides and pages
Browse the full glossary or read answers to common questions.
