A buyer asks for your SOC2 certification, and the first thing worth knowing is that no such certificate exists. SOC 2 is an examination performed by a licensed CPA firm, and what the firm issues at the end is an assurance report with an opinion in it, not a badge awarded by a standards body. The AICPA writes the professional standards those engagements run under and publishes the control criteria they are judged against; it certifies nobody. That distinction matters to the person who has to budget for this, because a report has a period, an opinion, a set of exceptions and an expiry the market reads into it, and a certificate would have none of those. This page says what the report is, what the criteria are, which of the two report types a buyer is usually asking for, who genuinely needs one, and where the free sheets on this site work the evidence load and the audit days from your own register with no account.
What is SOC 2 compliance, once the certificate idea is dropped
It is the state of having controls that meet the criteria your report covers, and evidence that they operated, for a stated period, in a form a CPA firm will sign an opinion about. Nothing is awarded and nothing is renewed on a schedule someone else keeps. You choose the criteria, you choose the period, the firm examines what you did in it, and the report says what it found, exceptions included. A clean report with a narrow scope and a short period is worth less to a buyer than a qualified one covering everything for a year, which is why scope and period are the two numbers to settle before a fee is discussed. The obligations register sheet on this site turns your count of obligations, controls and evidence items into the reviewer hours that period will cost you.
The soc 2 five trust principles, and what the AICPA calls them now
The five are security, availability, processing integrity, confidentiality and privacy. They were the Trust Services Principles; since the 2017 Trust Services Criteria they are categories, and the document the AICPA publishes is a set of control criteria with points of focus under each, revised in 2022. The wording is not pedantry. Only security is in every engagement; the other four are in scope because you put them there, and each one you add brings its own criteria, its own evidence and its own reviewer hours. A program that asks for all five in its first year has quintupled the evidence it has to produce before it has learned how long producing any of it takes.
Type 1 and Type 2: what a SOC 2 Type 2 attestation adds
A Type 1 report tests whether the controls were suitably designed at a single date. A Type 2 report tests whether they also operated effectively across a period, usually three to twelve months. That is the whole difference, and it is the reason a Type 1 costs less and buys less: it proves the design, not the habit. Most buyers asking for a report mean a Type 2, and most first-time programs buy a Type 1 to answer a live deal and then run a Type 2 window immediately after. The audit scope sheet on this site works the days a given scope takes, so the choice between the two can be priced rather than guessed.
Who needs a soc 2 report, and who is only being asked for one
Nobody needs one by law. A SOC 2 report is a commercial document, produced because a customer, a prospect or an insurer asked for evidence that a service organization handles their data the way it says it does. So the real question is who is asking, what they will accept, and what it costs to give it to them. A single enterprise deal that will close on a Type 1 and a remediation plan is a different project from a procurement policy that will accept nothing but an annual Type 2 across four categories. Ask for the clause. Buyers often ask for a certification because that is the word in their template, and will accept the report their own security team actually reads.
The soc 2 questionnaire the report is meant to replace
Before the report exists, every deal arrives with its own security questionnaire, and each one is answered by hand from the same register. The commercial case for the examination is largely that one report answers most of them, and the reviewer hours the questionnaires were costing stop. That case can be worked out rather than asserted: count the questionnaires you answered last year, multiply by the hours each took, and compare the total with the audit fee plus the evidence load the register sheet computes. Programs that do this arithmetic sometimes find the questionnaires are cheaper for another year, which is a legitimate answer.
Audit attestation, examination, certification: three different words
An audit, in the accounting sense, is an opinion on financial statements. An attestation engagement is an opinion on somebody else's assertion about something else, which is what a SOC 2 is: management asserts, the firm examines, the firm reports. A certification is a mark issued by a body that owns a scheme, which is what ISO 27001 has and SOC 2 does not. The practical consequence is who you can buy the work from. The firm signing a SOC 2 report has to be a licensed CPA firm, and the AICPA refers unlicensed practitioners to state boards of accountancy, so a low quote from a vendor that is not one buys a document no buyer's security team will accept.
Questions people ask about soc2 certification
What is SOC2 compliance, written without the space?
The same thing. SOC2 and SOC 2 are one subject; the AICPA writes SOC 2, most vendors write SOC2, and the unspaced form is simply the one people type. Nothing about the criteria, the report types or the fee changes with the spelling.
What is the difference between soc1 and soc2?
The criteria. A SOC 1 report is about controls over financial reporting at a service organization, written for your customers' auditors. A SOC 2 report is about security, availability, processing integrity, confidentiality or privacy, written for your customers' security and procurement teams. Both are attestation engagements by a CPA firm, and both come in a Type 1 and a Type 2.
Is there a SOC 2 certificate we can put on the website?
No. There is a report, which is confidential and released under an NDA, and the AICPA's SOC logo, which a firm may license you to display once an examination is complete. Anyone selling a wall certificate is selling the thing that does not exist.
How long does a report stay current?
The report covers its stated period and nothing after it. Buyers commonly treat a Type 2 as current for twelve months from the period end and ask for a bridge letter to cover the gap between that end and the date they are asking. Running the next period back to back is what keeps the coverage continuous.
Does Attestvio Pro get us through the examination?
It keeps the record the examination reads: the obligations, the controls, the evidence with its owner and date, the incidents, the cases and each period's attestation, on one screen per obligation. It gives no opinion on what a criterion requires and it is not the CPA firm. The free sheets here work the evidence load and the audit days; Pro is $29 a month and keeps the record they describe.