Question 1

Is SOC 2 a certification?

Accepted Answer

No, and the difference matters more than it sounds. SOC 2 is an attestation. A licensed CPA firm examines your controls under the AICPA's attestation standards and issues a report carrying an opinion. Nobody awards you a certificate. There is no register your name appears on. What you hand a customer is the report. The AICPA's own journal notes that compliance is a term never used in SOC 2 examinations. ISO/IEC 27001 is the certification here: accredited body, certificate, expiry date. If your customer asked for a certificate, ask which they meant.

Question 2

What is SOC 1 and do I need one?

Accepted Answer

You need one if your service affects your customers' financial reporting. SOC 1 covers internal control over financial reporting. SOC 2 covers security and the other trust services criteria. A payroll processor or a billing platform gets asked for SOC 1. A product that stores data but never touches the numbers in an audited statement does not. Some companies are asked for both, and they are separate engagements with separate reports. If a customer asks for SOC 1, ask which of your services they think affects their financials. The answer is occasionally that they meant SOC 2.

Question 3

What is SOC 3 and should I publish one?

Accepted Answer

SOC 3 is the version you may put on your website. A SOC 2 report is restricted to specified parties, so you cannot publish it and you should be wary of anyone who does. SOC 3 covers the same examination and strips the detail: management's assertion, the boundaries of the system, your service commitments, and the auditor's report. No control descriptions and no test results. That makes it useful as a public signal and useless as diligence. Publish one if you want something linkable. Expect a serious reviewer to ask for the SOC 2 anyway.

Question 4

What is a service organization, and am I one?

Accepted Answer

You are one if another company relies on your controls to run their own. That is the whole test. Your customer has outsourced a function to you. Storing their data. Processing their transactions. Running part of their operation. Their auditors and their risk team now care how you run it, because your weaknesses land in their environment. Being a service organization is not a status you apply for. It describes your position in somebody else's supply chain, and it is why they ask.

Question 5

What is SOC for Cybersecurity and is it what I need?

Accepted Answer

It is a different examination, and it is seldom what your customer means. The AICPA introduced SOC for Cybersecurity in 2017, for organizations wanting to communicate about their cybersecurity risk management programme as a whole. SOC 2 examines controls over a defined system against named trust services criteria. The audiences differ. One speaks to a board, the other to a customer doing vendor diligence. When your procurement contact asks for a SOC report, they mean SOC 2. Offering the other reads as a substitution.

Question 6

Everyone says they are compliant. What does that word mean here?

Accepted Answer

In a SOC 2 context, nothing. The AICPA's own journal notes that compliance is a term never used in SOC 2 examinations, and that vendors promise it anyway. What exists is an examination, an opinion, and a report covering a defined system for a defined period. Compliant is a word from another vocabulary, attached to this one by marketing. This matters past pedantry. Write it about yourself and a reader who knows the field learns something about how carefully you write. It is not what you intended.