SOC 2 Report: What It Covers and Type 1 vs Type 2

A SOC 2 report looks at controls at a "service organization," such as a cloud software vendor or a data center. It is meant for that organization's customers and their partners, who are called user entities. The auditor reports on controls relevant to one or more of five Trust Services Criteria:

A report may cover some or all of the five. Check which ones are in scope. A report that covers only security says nothing about the other areas.

Sources: AICPA and CIMA, SOC 2 publication title, "Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy"; LogicGate, "What Is SOC 2 Compliance?"; Schellman, "SOC 2 Reports"

There are two kinds of SOC 2 report. The difference is time.

For a buyer, this is the most important line on the cover page. A Type 1 report cannot show that a control worked over time, because the auditor only checked its design on one date. If you rely on a vendor for sensitive data, ask for a Type 2.

Sources: Secureframe, "SOC 2 Type 1 vs Type 2"; Vanta, "Type 1 vs. Type 2 SOC reports"

SOC 1 reports fall under the attestation standard SSAE 18 (AT-C section 320). SOC 2 reports fall under SSAE 21 (AT-C sections 105 and 205). Because a SOC 3 is short and public, it is useful as a first look but is no substitute for the full SOC 2.

Sources: Schellman, "Types of SOC Reports"; Vanta, "Types of SOC reports"

Most SOC 2 reports have five sections:

1. The auditor's report. States the scope and the auditor's opinion.
2. Management's assertion. The vendor's own statement about its system and controls.
3. System description. What services, systems, people and processes are covered.
4. Tests of controls. Each control, how the auditor tested it, and the result. Type 2 reports show any exceptions here.
5. Other information. Optional. Vendors sometimes respond to exceptions in this section.

The auditor's opinion uses set terms:

Many reports run to more than 100 pages. You do not need to read every page, but you do need to read the right ones.

Sources: Secureframe, "SOC 2 Report Structure" and "SOC 2 Report Example"

This is a practical reading order for a buyer.

1. Check the type and dates. Is it Type 1 or Type 2? What period does it cover? A report about a period that ended long ago may not reflect today's controls.
2. Read the auditor's opinion. A clean result is called "unqualified." Any other word means you should find out why.
3. Check the scope. Does the system description include the exact product and services you are buying? A report on one product does not cover another.
4. Check the criteria. Which of the five Trust Services Criteria are in scope? If you need availability or privacy and only security is covered, ask why.
5. Scan the exceptions. In the tests of controls, find every exception. Ask the vendor what changed since.
6. Look for duties on your side. The system description may include user responsibilities: things the customer must do for the controls to work. Those are your job, not the vendor's.
7. Check the auditor. The work must be done by a licensed CPA firm. The AICPA has warned about firms that are unlicensed or not enrolled in peer review.

Write down what you found and any follow-up questions. That record helps your wider vendor review. See our guide to third party risk management.

Sources: Compyl, "Understanding the Scope of a SOC 2 Report"; Secureframe, "System description"; Schellman, "Types of SOC Reports"; AICPA and CIMA, SOC landing page statement on unlicensed firms

A clean SOC 2 is good evidence, but it has limits:

• It is not a guarantee. The report gives a level of assurance about controls, not a promise that a breach will never happen.
• It is bound by scope. Anything outside the system description was not tested.
• It ages. It covers a point in time or a past period. New risks appear after the report is written.
• It does not test you. The report covers the vendor's controls, not how your own team uses the service.
• It is voluntary. No business is legally required to get a SOC report. A vendor without one is a reason to ask more questions, not proof of weak security.

Bank regulators make a similar point. Their 2023 guidance on third party relationships says a bank may review SOC reports, and should consider whether the scope and results are relevant to the activity the vendor will perform.

For uptime promises and what happens when a vendor misses them, a SOC 2 is not the right document. Look at the service level agreement instead.

Sources: Compyl, "Limitations of SOC 2 Reports"; Vanta, "Are SOC reports required?"; Board of Governors of the Federal Reserve System, FDIC and OCC, "Interagency Guidance on Third-Party Relationships: Risk Management" (2023)

The criteria are not frozen. On October 26, 2026, the AICPA posted exposure drafts of proposed 2027 SOC 2 Trust Services Criteria and Description Criteria. An exposure draft is a proposal for public comment, not a final rule. Buyers who review many vendors should watch for the final version, since future reports will be written against it.

Sources: AICPA and CIMA, "AICPA Exposure Drafts: Proposed 2027 SOC 2 Trust Services Criteria and Description Criteria"

Ask early. Security review is part of the paper process in most software deals, and a late request can delay a signature by weeks. Put the request in your RFP so every vendor knows it is coming. Our RFP process guide shows where it fits. SOC 2 reports are meant for private sharing with customers and partners, so expect the vendor to set terms for access.

Sources: Weflow, "What is the paper process in MEDDPICC?"; Vanta, "Types of SOC reports"

• Enterprise software providers described in our B2B platform register.
• Why we rely on documents rather than claims: see the methodology.
• Short answers about how we work on the FAQ page.

1. What is a SOC 2 report?

   A SOC 2 report is an independent CPA firm's report on a service provider's controls. It covers one or more of five areas set by the AICPA: security, availability, processing integrity, confidentiality and privacy.

2. What is the difference between SOC 2 Type 1 and Type 2?

   A Type 1 report checks whether controls are designed well at one point in time. A Type 2 report also tests whether they worked over a period, typically 3 to 12 months.

3. What is SOC 2 in simple terms?

   SOC 2 is an audit of how a service company protects customer systems and data. The result is a report with an auditor's opinion on those controls.

4. Who can perform a SOC 2 audit?

   A licensed CPA firm performs a SOC 2 examination. The AICPA sets the standards for SOC work.

5. What is the difference between SOC 1 and SOC 2?

   SOC 1 covers controls that affect a customer's financial reporting. SOC 2 covers security and the other Trust Services Criteria.

6. Is a SOC 3 report the same as a SOC 2?

   No. A SOC 3 covers the same subject as a SOC 2 but in less detail, and it is meant for the public, while a SOC 2 is shared privately with customers and partners.

1. AICPA and CIMA, "Audit and Assurance: SOC 2." aicpa-cima.com
2. AICPA and CIMA, "System and Organization Controls: SOC Suite of Services." aicpa-cima.com
3. Secureframe, "SOC 2 Type 1 vs Type 2." secureframe.com
4. Secureframe, "A Real-World SOC 2 Report Example Explained." secureframe.com
5. Vanta, "What is a SOC report?" vanta.com
6. Schellman, "SOC 1 vs. SOC 2: Which SOC Report Do Data Centers Need?" schellman.com
7. LogicGate, "SOC 2 Compliance: Basics, Benefits, Types and Next Steps." logicgate.ai
8. Compyl, "Is a SOC 2 Report Sufficient to Ensure Organizational Security?" compyl.com
9. Federal Reserve, FDIC and OCC, "Interagency Guidance on Third-Party Relationships: Risk Management," 88 FR 37920 (June 9, 2023). federalregister.gov
10. Weflow, "MEDDPICC Sales Methodology." weflow.ai