Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a SOC 2 Report?

Definition

A SOC 2 report is an independent CPA firm's examination of a service provider's controls over security and, optionally, availability, processing integrity, confidentiality, and privacy. It is built on the AICPA's Trust Services Criteria. Businesses ask vendors for SOC 2 reports to judge whether it is safe to trust them with data.

How It Works

A service organization, such as a cloud app, payroll provider, or managed IT firm, hires a licensed CPA firm to examine its controls against the AICPA's 2017 Trust Services Criteria. Security is always in scope. The other four categories are added if relevant.

There are two types:

  • Type 1 reports on whether controls were suitably designed as of a single date.
  • Type 2 also tests whether the controls operated effectively over a period of time. For vendor review, a Type 2 says much more.

The report includes management's description of the system, the auditor's opinion, and in a Type 2, the tests performed and any exceptions found. It also lists complementary user entity controls: things the customer must do for the vendor's controls to work, such as managing its own users and MFA.

SOC 2 is an attestation, not a certification, and it is not a pass or fail badge. Reading one means checking the scope (does it cover the service you buy?), the period (is it current?), the opinion (is it qualified?), the exceptions, and your own responsibilities.

Real-World Example

In May 2026, the AICPA's Peer Review Board issued guidance to peer reviewers after growing concern about SOC 2 quality. An AICPA article said one specific risk was engagements "not designed to respond to the unique risks associated with the service organization, resulting in engagements that have identical reports, risk assessments, sample sizes, and testing procedures." Its ethics vice president said "some firms are leaning too heavily on third-party SOC platforms without applying the professional judgment required by our standards." Reviewers were told to examine engagement timelines, tool use, and tailoring.

Why It Matters for a Small Business

Small businesses meet SOC 2 from two sides. As buyers, they rely on cloud vendors holding their customer data, and a SOC 2 Type 2 report is often the best evidence available. As sellers, a small software or services firm may be asked for one by a larger customer. The AICPA's warning means a report is only as good as the auditor and the scope, so it should be read, not just collected. A clean report on the wrong service, or one that is two years old, gives false comfort, and the user entity controls are work your own team still has to do.

How to Spot It / How DTS Handles It

Warning signs: vendors approved without any security review, SOC 2 reports filed unread, reports that are Type 1 only or more than a year old, scopes that exclude the service you use, and nobody tracking the user entity controls your business is responsible for.

DTS can review vendor SOC 2 reports for scope, period, exceptions, and the user entity controls you are responsible for, and can help firms get ready for their own examination. Only licensed CPA firms issue SOC 2 reports; DTS does not. See our vCISO service.

Related Terms

  • Vendor risk management: where SOC 2 reports get used.
  • Shared responsibility model: the customer's half of cloud security.
  • Supply chain attack: the risk vendor reviews try to reduce.
  • ISO/IEC 27001: an international certification often compared with SOC 2.
  • Security control: what the auditor tests.
  • Cyber insurance: insurers also ask about vendor oversight.

Sources

  • AICPA and CIMA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022): https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
  • AICPA and CIMA, System and Organization Controls: SOC Suite of Services: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
  • Journal of Accountancy (AICPA), AICPA guides peer reviewers to address SOC 2 risks (May 14, 2026): https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/

Last updated October 14, 2026.