Audit framework for service organisations demonstrating security, availability, and data handling controls.
SOC 2 (System and Organization Controls 2) is an auditing framework for service organisations, assessing controls relevant to security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports are produced by independent auditors following AICPA standards. Type I reports assess control design at a point in time; Type II reports assess operating effectiveness over a period (typically 6-12 months). SOC 2 is commonly required when providing services to US enterprises.
Why It Matters
The DSC Perspective:
SOC 2 is often required by US enterprise customers evaluating service providers. Type II reports carry more weight as they demonstrate controls work over time, not just on audit day.