SOC 2
A compliance framework developed by the AICPA that evaluates an organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports are the standard proof of security for SaaS and cloud service providers.
Why it matters
SOC 2 has become the default security credential that enterprise buyers in North America request from their SaaS vendors. A SOC 2 Type II report provides independent assurance that your controls operated effectively over a period of time, not just that they existed at a point in time. The report is issued by a CPA firm after an audit, giving it credibility that self-assessments lack. For European companies serving US customers, SOC 2 alongside ISO 27001 covers both markets.
In practice
SOC 2 compliance involves selecting which Trust Services Criteria apply (security is mandatory, others are optional), mapping controls to those criteria, operating those controls consistently, collecting evidence, and undergoing an audit. Type I reports assess design at a point in time. Type II reports assess operating effectiveness over 3-12 months. In vucavoid, SOC 2 is available as a blueprint. Controls mapped to Trust Services Criteria generate continuous evidence through effectiveness reports, keeping you audit-ready year-round rather than scrambling before each engagement.