SOC 2 Report Scoping Assessment
Helps decide Type 1 or Type 2, the categories to include, the system boundary and the length of the observation period.
Available soon
Answer it online instead: Which SOC 2 report do we need?About 10 minutes, free, and nothing is stored.
- Format
- Excel
- Size
- 73 KB
- Length
- 11 sheets
- Version
- 1.1
- Updated
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Gather the facts first: the customer requests and contracts that mention SOC 2, the service levels and other written commitments you make, the list of providers that run parts of the service, the date each customer needs the report, and any minimum length of period a customer states. The Examination owner ([[name; often the Head of Information Security or a compliance lead]]) owns the assessment. The Executive sponsor decides scope questions that cost money. Legal reads the contracts. |
| 2 | On the Assessment sheet, fill in the details at the top, then answer SQ-01 to SQ-13 in order from the drop-down lists. For each answer record the fact and where it comes from (an email, a contract clause, a service level, a provider's report), then your reasoning. The Check column says what is still missing. |
| 3 | SQ-02: count from the day a control began to run and left records, not from the day it was written down. A control that is designed but not yet running counts as not running. Controls should have operated for at least 3 months before a first Type 2 period starts (a house default, SR-10). |
| 4 | SQ-04 and SQ-05: ask each customer for the date the report must be in their hands and for any minimum length of period. A Type 2 report takes the period plus the time the CPA firm needs to issue it. This workbook allows 2 months for that (a house default: ask your CPA firm). A customer's stated minimum overrides the period that would otherwise fit your date. |
| 5 | SQ-06 to SQ-09: Security is always in scope, so it is not asked: the common criteria are part of a report on any category. Add Availability, Confidentiality, Processing Integrity or Privacy only where a customer or contract requires it or where you make a written commitment, because each category adds criteria and evidence (SR-03). |
| 6 | SQ-10 and SQ-11: list every provider that runs part of the service, and whether it gives you its own SOC 2 report. You decide the carve-out or the inclusive method for each provider that matters to the criteria, before the system description is written (SR-06). |
| 7 | Read the Result sheet: the report type, the row of the decision table that decided it, the observation period, the categories, the number of criteria in scope and the prompts that apply. The Decision Table sheet shows every row and marks the rows that match your answers. Rows are read from the top and the first match decides. |
| 8 | Use the Cases sheet to test your reading. It runs typical cases through the same formulas. Add a case of your own on a blank row to see what the table would decide if one answer changed. |
| 9 | Use the result in the System Description & Boundary Template (the boundary and the system description), the SOC 2 Readiness Self-Assessment and the Readiness Assessment Procedure. Write down why the scope is what it is, and reassess when anything on the list at the foot of the Result sheet changes (SR-08). |
| 10 | To clear the EXAMPLE, delete the word EXAMPLE in E5 of the Assessment sheet and replace every yellow cell there. The 7 cases on the Cases sheet stay: they show how the table decides typical cases. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule SR-03: "Choose the report to fit the commitments you have made. Treat Security as always in scope: its common criteria (CC1 to CC9) are part of a report on any category, so a report on Availability alone still includes all 33. Add Availability, Confidentiality, Processing Integrity or Privacy only where a customer or a written commitment needs it, because each adds criteria and evidence."
Rule SR-05: "Choose Type 2 unless there is a reason not to. Use a Type 1 report only as a stated first step, for example when the controls are new or a customer date cannot wait, and plan the Type 2 period to begin straight after."
Rule SR-08: "Re-scope when the service, the boundary, a major provider or a customer commitment changes, and before each new period. Write down why the scope is what it is."
EXAMPLE: Acme Corp (EXAMPLE) is a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report. Row RT-5 decides: report type Type 2, an observation period of 6 months, Security, Availability, Confidentiality in scope (38 criteria), and 4 prompts (PR-1, PR-2, PR-3, PR-6).
A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.
Numbers: the period lengths and the allowance for issuing the report are market practice and house defaults, not rules of the AICPA. The CPA firm agrees the period with you in the engagement letter, and your customers decide what they accept.
Tailoring: small organisation. A small team gains most from keeping the scope narrow: Security alone, and one report type that fits the nearest customer date. Add a category only on a written request, because each one adds criteria and evidence that a small team has to keep. Answer all 13 questions all the same: the shorter the list of controls, the more it helps to know their boundary and providers early.
Tailoring: customer-driven or regulated. Where a customer's contract or procurement policy sets the report type, the categories or the minimum period, record the clause in the fact column and take it as the answer. If two customers ask for different things, answer for the one report you will commission, and record what each customer asked so that the sponsor can see which request the report does not serve. Nothing in law makes a SOC 2 report mandatory. The decision to commission one is yours.
Tailoring: IT and services run by providers. SQ-10 and SQ-11 matter most. A provider whose controls matter to the criteria is carved out or included, and a carve-out leaves a list of controls you assume the provider operates and a duty to watch that it does (P06 TP-09). See P06-A03 Supplier Security Assessment Procedure for how a provider's own SOC 2 report is read.
Limitations: This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.
Assessment
Scope assessment
Answer every question from the list, and record the fact, its source and your reasoning. Yellow cells are yours; grey cells are calculated.
| Worked example | EXAMPLE | Delete EXAMPLE here, and replace every yellow cell, to record your own assessment. | ||||
| Organisation | Acme Corp (EXAMPLE) | |||||
| The one service the report would be about | EXAMPLE: Ledgerline, a hosted invoicing and approvals service for finance teams | |||||
| Date of the assessment | 30 Sep 2026 | |||||
| Assessed by | EXAMPLE: Examination owner | |||||
| ID | Question | Why it matters | Your answer | Fact and its source | Reasoning | Check |
|---|---|---|---|---|---|---|
| SQ-01 | What has your customer, or the market you sell to, asked for? | What was asked decides whether a Type 1 report is a stepping stone or the answer. | A SOC 2 Type 2 report | Two enterprise customers asked for a SOC 2 Type 2 report in their security reviews. [[customer names and dates of the requests]] | A Type 2 report is what was asked, so a Type 1 report would be a stepping stone at most. | OK |
| SQ-02 | For how long have the controls you would put in the report operated, with records? | A control must run before it can be observed. A Type 2 report is about operation over time. | Less than 3 months | Most controls began to run recently, after a security programme started this year. [[date each key control began and where its first record is]] | The records for the newest controls are short. The first period will be short too, and the readiness self-assessment comes first. | OK |
| SQ-03 | Have you had a SOC 2 report before? | A second Type 2 report follows straight on from the first. | No | No SOC 2 report has been issued before. Customers have so far relied on security questionnaires. | This is a first examination, so there is no earlier period to continue. | OK |
| SQ-04 | When must the report be in the customer's hands? | A Type 2 report takes the period plus the time the CPA firm needs to issue it. The question asks for a range and the method reads the far end of it. If your date is near the earlier end, answer with the earlier range. | In 6 to 12 months | The larger customer's renewal is about a year away and it wants the report before then. [[date from the customer's email]] | The date leaves room for a period of several months and for the time the CPA firm needs to issue the report. | OK |
| SQ-05 | Does a customer state a minimum length for the period? | A customer's stated minimum overrides what would otherwise fit your date. | No | Neither customer states a minimum length in writing. [[confirm with each customer]] | Without a stated minimum the period is the one that fits the date. | OK |
| SQ-06 | Availability: is it needed? | Add a category only where it is needed. | A customer or contract requires it | The larger customer's contract sets a service level: 99.9% monthly availability of the web application and API (as the customer contract's service level states it). [[contract clause]] | The customer asks for the report to cover Availability, so it is included. | OK |
| SQ-07 | Confidentiality: is it needed? | Add a category only where it is needed. | We make written commitments on confidential information, such as retention or deletion | The terms of service say: Customer data is deleted within 60 days of the end of the contract on request. [[clause]] | A written commitment about the deletion of customers' information is a reason to include Confidentiality. | OK |
| SQ-08 | Processing Integrity: is it needed? | Add a category only where it is needed. | No | No contract commits to processing that is accurate, complete or timely, and no customer has asked. [[check with Legal]] | Not included now. Revisit it if a customer asks or a contract adds a commitment on accuracy (SR-08). | OK |
| SQ-09 | Privacy: is it needed? | Add a category only where it is needed. | No | The service holds the business contact details of customers' staff. No customer has asked for a report on personal information. [[check with Legal]] | Not included now. Revisit it if a customer asks, or if the service starts to hold personal information for a customer's own users. | OK |
| SQ-10 | Do other providers run parts of the service for you? | Each provider that matters to the criteria needs a carve-out or an inclusive decision. | Yes, several providers | [[Hosting provider]] (EXAMPLE) (cloud infrastructure); [[Email delivery provider]] (EXAMPLE) (outbound notification email); [[Payment processor]] (EXAMPLE) (card payments for subscriptions). | Three providers, so the answer is several. The payment processor sits outside the boundary, and the other two matter to the criteria. | OK |
| SQ-11 | Do those providers give you their own SOC 2 reports? | Under a carve-out you rely on the provider's report and your monitoring of it. | Some of them | The hosting provider's SOC 2 report is held. The email delivery provider's report has been requested. The payment processor's report is not needed. | Some of them give a report, so the answer is Some of them. | OK |
| SQ-12 | Is the boundary of the system agreed? | The description and every control depend on the boundary. | Partly: we know the service but not its edge | The service is named and its main parts are known. The edge of the system, such as the support tools and the build pipeline, is not written down. [[link to the draft boundary]] | Partly. The boundary is drawn first, in the system description template. | OK |
| SQ-13 | Do you need a report you can publish or hand to anyone? | A SOC 2 report is generally restricted in use. A SOC 3 report is for general use. | No, customers under a confidentiality agreement are enough | Customers who ask are under a confidentiality agreement. [[confirm with the customer-facing lead]] | A restricted report is enough for now. | OK |
Decision Table
The report-type decision table
The report-type test as 5 rows. Rows are read from the top, and the first that matches the answers decides. Nothing on this sheet is yours to change.
| Row | When | Report type | Matches the answers? | Decides? |
|---|---|---|---|---|
| RT-1 | Key controls are not yet designed or not yet in place (SQ-02). | Get ready first | No | |
| RT-2 | You have had a Type 2 report before (SQ-03). | Type 2 | No | |
| RT-3 | The customer asked for a Type 1 report (SQ-01). | Type 1 | No | |
| RT-4 | The report is due within 3 months (SQ-04). | Type 1, then Type 2 | No | |
| RT-5 | None of the rows above matches. | Type 2 | Yes | Decides |
| Position of the first row that matches | 5 | |
What each report type means
| Report type | What it means and what to do | |||
|---|---|---|---|---|
| Get ready first | Do not start either report yet. A Type 1 report examines the design of controls in place on one date, and a Type 2 report their operation over a period, so controls that are not designed or not in place cannot be examined as they stand. Use the readiness assessment, close the blocking items and come back. Telling the customer where you are, in plain words, is better than a rushed report. | |||
| Type 2 | A report on the design and operating effectiveness of your controls over a period. It is what most customers who ask for SOC 2 mean, and the pack's default (SR-05). The period below is the one that fits your date and any stated minimum. | |||
| Type 1 | A report on the description and the design of your controls as of one date. The customer asked for it. Plan the Type 2 period to start straight after, because customers usually go on to ask for it (market practice). | |||
| Type 1, then Type 2 | Your date is too close for a Type 2 report to be issued, so a Type 1 report as of a date inside the window, followed by a Type 2 period that starts straight after, is the usual route. Say plainly to the customer which one they will have, and when (SR-01). | |||
Numbers the method reads
| SQ-04: the date answer | Months to the date | |
|---|---|---|
| Within 3 months | 3 | |
| In 3 to 6 months | 6 | |
| In 6 to 12 months | 12 | |
| In more than 12 months | 24 | |
| No date is set (if the date is not known, ask the customer before relying on this result) | ||
| SQ-05: the minimum answer | Months of the minimum | |
|---|---|---|
| No | 0 | |
| Yes: 3 months | 3 | |
| Yes: 6 months | 6 | |
| Yes: 12 months | 12 | |
| Setting | Months | |
|---|---|---|
| Type 2 period length 1 of 3 (market practice, not an AICPA rule) | 3 | |
| Type 2 period length 2 of 3 (market practice, not an AICPA rule) | 6 | |
| Type 2 period length 3 of 3 (market practice, not an AICPA rule) | 12 | |
| Months for the CPA firm to issue the report after the period ends (house default: ask your firm) | 2 | |
| Months of the Type 2 period that follows a Type 1 report where the report type is Type 1, then Type 2 (house default) | 6 | |
| Months the controls should have operated, with records, before a first Type 2 period starts (house default, printed in prompt PR-6) | 3 | |
The five categories and the criteria each holds
| Category | Criteria | When customers usually ask for it | ||
|---|---|---|---|---|
| Security | 33 | Always in scope. The common criteria (CC1 to CC9) are part of a report on any category. | ||
| Availability | 3 | Customers depend on the service being up, and your contracts or service levels commit to uptime or recovery. | ||
| Confidentiality | 2 | You hold customers' confidential information (not personal information) and your contracts commit to protecting, retaining or deleting it. | ||
| Processing Integrity | 5 | Customers rely on your processing being complete, accurate and timely, for example payments, payroll or calculations, and your contracts commit to it. | ||
| Privacy | 18 | You collect, use, keep or disclose personal information on customers' behalf or from their users, and customers ask you to report on how you handle it. | ||
| Security is always in scope, because its common criteria are part of a report on any category. Another category is in scope when its answer is that a customer or contract requires it, or that you make a written commitment. The number of criteria in scope is the Security criteria plus the criteria of each other category in scope. | ||||
The prompts and when each appears
| Prompt | When it appears | |||
|---|---|---|---|---|
| PR-1 | The boundary is not agreed: SQ-12 is anything other than the first answer. | |||
| PR-2 | Other providers run parts of the service: SQ-10 is not the answer that you run everything yourselves. | |||
| PR-3 | There are providers (SQ-10) and they do not all give you their own SOC 2 reports (SQ-11 is anything other than Yes, all of them). | |||
| PR-4 | You need a report you can publish or hand to anyone: SQ-13 is Yes. | |||
| PR-5 | The report type is Type 2 and the period, plus the time to issue the report, does not fit the date. | |||
| PR-6 | Your controls have operated for a short time only (SQ-02) and the report type is not Get ready first. | |||
| PR-7 | You have had a Type 2 report before (SQ-03 is Yes, a Type 2 report) and the report type is not Get ready first. | |||
| PR-8 | The report type is Get ready first. | |||
| PR-9 | You need a report you can publish or hand to anyone (SQ-13 is Yes) and the report type is not Type 2. | |||
| PR-10 | The report type is Type 2, the period is 3 months (the date is within 6 months and no customer states a longer minimum) and you have not had a Type 2 report before (SQ-03 is not Yes, a Type 2 report). | |||
| PR-11 | A customer asked for a Type 1 report (SQ-01) and you have had a Type 2 report before (SQ-03 is Yes, a Type 2 report). | |||
| PR-12 | SQ-10 says you run everything yourselves, but SQ-11 is anything other than Not applicable. | |||
| PR-13 | There are providers (SQ-10), but SQ-11 says Not applicable. | |||
| PR-14 | The report type is Type 1, then Type 2 and your controls have operated for 3 months or more with records (SQ-02). | |||
Result
Result and how it is worked out
The report type the decision table gives, the row that decided it, the period, the categories, the criteria in scope and what to settle next. Everything on this sheet is calculated from the Assessment sheet.
EXAMPLE: the example organisation's assessment, dated 2026-09-30. Clear the EXAMPLE on the Assessment sheet to record your own.
The result
| Report type | Type 2 | |||
|---|---|---|---|---|
| Row that decided it | RT-5 | |||
| That row reads | None of the rows above matches. | |||
| What it means | A report on the design and operating effectiveness of your controls over a period. It is what most customers who ask for SOC 2 mean, and the pack's default (SR-05). The period below is the one that fits your date and any stated minimum. | |||
| Months to the date the report is needed | 12 | |||
| Customer's minimum period (months) | Not stated | |||
| Period that fits your date (months) | 6 | |||
| Observation period (months) | 6 | |||
| Does the period fit your date (read at the far end of your range)? | Yes | |||
| Categories in scope | Security, Availability, Confidentiality | |||
| Criteria in scope | 38 | |||
| Prompts that apply | PR-1, PR-2, PR-3, PR-6 | |||
| Reasoning recorded | Complete: every answer has its fact, source and reasoning | |||
What to settle next
| Prompt | Applies? | What to settle next | ||
|---|---|---|---|---|
| PR-1 | Yes | Settle the boundary first (SR-04, A03). Everything else depends on it. | ||
| PR-2 | Yes | Decide carve-out or inclusive for each provider that matters to the criteria (SR-06). For a provider whose own SOC 2 report you hold, such as hosting, the carve-out is the usual choice in market practice: you list the controls you assume it operates and read its report. The inclusive method needs the provider's agreement and brings its controls into the examination. For a provider with no report, see the System Description & Boundary Template (A03). | ||
| PR-3 | Yes | Ask every provider for its SOC 2 report, or find out why it has none. A carve-out depends on the provider's own controls (P06 TP-09). | ||
| PR-4 | No | A SOC 2 report is generally restricted in use. Ask the CPA firm about a SOC 3 report for general use, and keep the SOC 2 report under a confidentiality agreement (SR-21). | ||
| PR-5 | No | The period and the time to issue the report do not fit your date. Talk to the customer about a Type 1 report before you commit. If you already hold a report, a bridge letter (SR-20) can cover the interval after its period. | ||
| PR-6 | Yes | Your controls have operated for less than 3 months. Expect exceptions early in a short first period, or consider a Type 1 report first, and have the readiness assessment (A09) done before the period starts (SR-10, SR-13). The period above is counted from today and does not include that wait. If a date is set, add the wait to the period before you compare it with the date. | ||
| PR-7 | No | Start the next period on the day after the last one ends so that no day is uncovered (SR-16). | ||
| PR-8 | No | Run the readiness self-assessment (A09). It shows the blocking items and where to start. | ||
| PR-9 | No | A SOC 3 report is issued only with a Type 2 examination, so there is no SOC 3 for a Type 1 report. Keep the SOC 2 report under a confidentiality agreement (SR-21) and ask the CPA firm about a SOC 3 report once you have a Type 2 report. | ||
| PR-10 | No | A period of 3 months is short for a first Type 2 report. The AICPA's SOC 2 guide sets no minimum, but says a period under two months is unlikely to give the CPA firm enough evidence (paragraph 2.54), and some customers and CPA firms will expect six months, which the guide does not state. Confirm that the customer and the CPA firm accept 3 months before you commit (market practice). | ||
| PR-11 | No | A customer asked for a Type 1 report, but you already hold a Type 2 report, so the result follows the Type 2 history. Ask the customer whether it will accept the Type 2 report. | ||
| PR-12 | No | SQ-10 says no provider runs any part of the service, but SQ-11 is not Not applicable. Correct one of the two answers before you rely on this result. | ||
| PR-13 | No | SQ-10 says other providers run parts of the service, but SQ-11 says Not applicable. Answer SQ-11 for those providers before you rely on this result. | ||
| PR-14 | No | The period above is counted from today. If your controls have already operated for 3 months or more with records, ask the CPA firm whether a Type 2 examination can cover a period that has already run. The pack has not verified what the AICPA's SOC 2 guide says about that, so it does not assume it: if the firm agrees, a Type 2 report may fit your date without a Type 1 report first. | ||
A prompt appears when its condition on the Decision Table holds. A prompt is a thing to settle next. It is not a finding and it says nothing about your controls.
How the result is worked out
The Decision Table sheet holds 5 rows. They are read from the top, and the first row that matches your answers decides the report type. The last row matches when none of the rows above it does.
For a Type 2 report the observation period is the longest of 3, 6 and 12 months that still fits your date once 2 months for the CPA firm to issue the report are added. These lengths are market practice and the 2 months is a house default. Neither is a rule of the AICPA. With no date set the longest is used, and if no length fits the shortest is used and the result says that it does not fit. The period is counted from today: if your controls have run for under 3 months, add the weeks until they have run for 3 months (SR-10). The date question asks for a range and the method reads the far end of it, so if your date is near the earlier end, answer with the earlier range. If a customer states a minimum that is longer than the period that fits, the minimum is used, and the result says whether that still fits your date.
If the report type is Type 1, then Type 2, your date is too close for a Type 2 report to be issued. The Type 2 period that follows is 6 months (a house default), or the customer's minimum if that is longer. For Get ready first and for a Type 1 report there is no observation period to choose here.
Security is always in scope, because its common criteria are part of a report on any category. Another category is added only when you answer that a customer or contract requires it or that you make a written commitment. The criteria in scope are the Security criteria plus those of each other category chosen, so a report on Availability alone has the Security criteria and the Availability criteria: Security 33, Availability 3, Confidentiality 2, Processing Integrity 5, Privacy 18.
The 14 prompts PR-1 to PR-14 are the things to settle next. Each appears when its condition holds, as the Decision Table sheet sets out.
The reasoning, as recorded on the Assessment sheet
| Question | Answer | Fact and its source | Reasoning | |
|---|---|---|---|---|
| SQ-01 | A SOC 2 Type 2 report | Two enterprise customers asked for a SOC 2 Type 2 report in their security reviews. [[customer names and dates of the requests]] | A Type 2 report is what was asked, so a Type 1 report would be a stepping stone at most. | |
| SQ-02 | Less than 3 months | Most controls began to run recently, after a security programme started this year. [[date each key control began and where its first record is]] | The records for the newest controls are short. The first period will be short too, and the readiness self-assessment comes first. | |
| SQ-03 | No | No SOC 2 report has been issued before. Customers have so far relied on security questionnaires. | This is a first examination, so there is no earlier period to continue. | |
| SQ-04 | In 6 to 12 months | The larger customer's renewal is about a year away and it wants the report before then. [[date from the customer's email]] | The date leaves room for a period of several months and for the time the CPA firm needs to issue the report. | |
| SQ-05 | No | Neither customer states a minimum length in writing. [[confirm with each customer]] | Without a stated minimum the period is the one that fits the date. | |
| SQ-06 | A customer or contract requires it | The larger customer's contract sets a service level: 99.9% monthly availability of the web application and API (as the customer contract's service level states it). [[contract clause]] | The customer asks for the report to cover Availability, so it is included. | |
| SQ-07 | We make written commitments on confidential information, such as retention or deletion | The terms of service say: Customer data is deleted within 60 days of the end of the contract on request. [[clause]] | A written commitment about the deletion of customers' information is a reason to include Confidentiality. | |
| SQ-08 | No | No contract commits to processing that is accurate, complete or timely, and no customer has asked. [[check with Legal]] | Not included now. Revisit it if a customer asks or a contract adds a commitment on accuracy (SR-08). | |
| SQ-09 | No | The service holds the business contact details of customers' staff. No customer has asked for a report on personal information. [[check with Legal]] | Not included now. Revisit it if a customer asks, or if the service starts to hold personal information for a customer's own users. | |
| SQ-10 | Yes, several providers | [[Hosting provider]] (EXAMPLE) (cloud infrastructure); [[Email delivery provider]] (EXAMPLE) (outbound notification email); [[Payment processor]] (EXAMPLE) (card payments for subscriptions). | Three providers, so the answer is several. The payment processor sits outside the boundary, and the other two matter to the criteria. | |
| SQ-11 | Some of them | The hosting provider's SOC 2 report is held. The email delivery provider's report has been requested. The payment processor's report is not needed. | Some of them give a report, so the answer is Some of them. | |
| SQ-12 | Partly: we know the service but not its edge | The service is named and its main parts are known. The edge of the system, such as the support tools and the build pipeline, is not written down. [[link to the draft boundary]] | Partly. The boundary is drawn first, in the system description template. | |
| SQ-13 | No, customers under a confidentiality agreement are enough | Customers who ask are under a confidentiality agreement. [[confirm with the customer-facing lead]] | A restricted report is enough for now. | |
Before you rely on it
This result is guidance for planning. It is guidance, not an audit decision, and it is not an opinion. Only a licensed CPA firm can examine your description and controls and give an opinion, and the firm decides what it will examine and how the report reads.
No report type is a certification: a Type 1 report and a Type 2 report are both attestations by a CPA firm.
A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.
Confirm the report type, the categories and the dates with the CPA firm before you commit to a customer, and agree the observation period in writing with the firm (SR-16). The customer decides which report it accepts.
Rule SR-22: "ISO/IEC 27001 certification and a SOC 2 report are different things, from different bodies, about different subjects. Neither equals or replaces the other. Say what you hold and let the customer decide what it accepts (P08, P26)."
The period lengths, the allowance of 2 months to issue the report, the 3 months of operation before a first Type 2 period and the 3 months a bridge letter usually covers are market practice and house defaults. They are not rules of the AICPA.
This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.
Reassess when
• The service, its boundary, a major provider or a customer commitment changes (SR-08: "Re-scope when the service, the boundary, a major provider or a customer commitment changes, and before each new period. Write down why the scope is what it is.").
• A customer or contract asks for a category you have not included, or drops one you have.
• A customer states a minimum period, or a new date, that you did not have when you answered SQ-04 and SQ-05.
• A control you counted as running at SQ-02 stops running, or a new one starts.
• A provider is added, replaced or stops giving you its report (SQ-10 and SQ-11).
• Before you agree the dates of each new period with the CPA firm.
Cases
Typical cases run through the same decision table and the same formulas as the Result sheet. Add a case of your own on a blank row to see how the table decides it.
| Case | SQ-01 asked | SQ-02 operated | SQ-03 prior | SQ-04 deadline | SQ-05 minimum | SQ-06 AVL | SQ-07 CON | SQ-08 PIN | SQ-09 PRV | SQ-10 providers | SQ-11 providerReports | SQ-12 boundary | SQ-13 public | Row that decides | Report type | Months to the date | Minimum (months) | Period that fits (months) | Observation period (months) | Fits the date? | Categories in scope | Criteria in scope | Prompts | Expected report type | Expected period (months) | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Controls not yet running | A SOC 2 Type 2 report | Not yet: key controls are not designed or not in place | No | In 6 to 12 months | No | A customer or contract requires it | We make written commitments on confidential information, such as retention or deletion | No | No | Yes, several providers | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough | RT-1 | Get ready first | 12 | 0 | Not applicable | Not applicable | Not applicable | Security, Availability, Confidentiality | 38 | PR-1, PR-2, PR-3, PR-8 | Get ready first | Agrees | |
| A second Type 2 report | A SOC 2 Type 2 report | 3 months or more | Yes, a Type 2 report | No date is set (if the date is not known, ask the customer before relying on this result) | No | A customer or contract requires it | We make written commitments on confidential information, such as retention or deletion | No | No | Yes, several providers | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough | RT-2 | Type 2 | No date set | 0 | 12 | 12 | Yes | Security, Availability, Confidentiality | 38 | PR-1, PR-2, PR-3, PR-7 | Type 2 | 12 | Agrees |
| The customer asked for a Type 1 report | A SOC 2 Type 1 report | 3 months or more | No | In 6 to 12 months | No | A customer or contract requires it | We make written commitments on confidential information, such as retention or deletion | No | No | Yes, several providers | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough | RT-3 | Type 1 | 12 | 0 | Not applicable | Not applicable | Not applicable | Security, Availability, Confidentiality | 38 | PR-1, PR-2, PR-3 | Type 1 | Agrees | |
| Due within three months | A SOC 2 Type 2 report | 3 months or more | No | Within 3 months | No | A customer or contract requires it | We make written commitments on confidential information, such as retention or deletion | No | No | Yes, several providers | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough | RT-4 | Type 1, then Type 2 | 3 | 0 | 6 | 6 | Not applicable | Security, Availability, Confidentiality | 38 | PR-1, PR-2, PR-3, PR-14 | Type 1, then Type 2 | 6 | Agrees |
| Six-month date, no minimum | A SOC 2 Type 2 report | 3 months or more | No | In 3 to 6 months | No | A customer or contract requires it | We make written commitments on confidential information, such as retention or deletion | No | No | Yes, several providers | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough | RT-5 | Type 2 | 6 | 0 | 3 | 3 | Yes | Security, Availability, Confidentiality | 38 | PR-1, PR-2, PR-3, PR-10 | Type 2 | 3 | Agrees |
| Six-month date, customer wants 12 months | A SOC 2 Type 2 report | 3 months or more | No | In 3 to 6 months | Yes: 12 months | A customer or contract requires it | We make written commitments on confidential information, such as retention or deletion | No | No | Yes, several providers | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough | RT-5 | Type 2 | 6 | 12 | 3 | 12 | No | Security, Availability, Confidentiality | 38 | PR-1, PR-2, PR-3, PR-5 | Type 2 | 12 | Agrees |
| No date | A SOC 2 Type 2 report | 3 months or more | No | No date is set (if the date is not known, ask the customer before relying on this result) | No | A customer or contract requires it | We make written commitments on confidential information, such as retention or deletion | No | No | Yes, several providers | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough | RT-5 | Type 2 | No date set | 0 | 12 | 12 | Yes | Security, Availability, Confidentiality | 38 | PR-1, PR-2, PR-3 | Type 2 | 12 | Agrees |
Lists
| AnsSQ01 | AnsSQ02 | AnsSQ03 | AnsSQ04 | AnsSQ05 | AnsSQ06 | AnsSQ07 | AnsSQ08 | AnsSQ09 | AnsSQ10 | AnsSQ11 | AnsSQ12 | AnsSQ13 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| A SOC 2 Type 2 report | Not yet: key controls are not designed or not in place | Yes, a Type 2 report | Within 3 months | No | A customer or contract requires it | A customer or contract requires it | A customer or contract requires it | A customer or contract requires it | Yes, several providers | Yes, all of them | Yes: one named service, written down, with what is outside it | Yes |
| A SOC 2 Type 1 report | Less than 3 months | Yes, a Type 1 report only | In 3 to 6 months | Yes: 3 months | We make a written commitment on uptime or recovery | We make written commitments on confidential information, such as retention or deletion | We make written commitments that processing is accurate, complete or timely | We make written commitments about personal information, such as notice, choice or deletion | Yes, one provider, for example our hosting | Some of them | Partly: we know the service but not its edge | No, customers under a confidentiality agreement are enough |
| A SOC 2 report, without saying which type | 3 months or more | No | In 6 to 12 months | Yes: 6 months | No | No | No | No | No, we run everything ourselves | None, or we have not asked | No | |
| Nobody has asked yet; we want one ready | In more than 12 months | Yes: 12 months | Not applicable: no providers |
No date is set (if the date is not known, ask the customer before relying on this result)
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Attestation | An independent professional's written opinion on a subject that someone else (management) is responsible for. A SOC 2 report is an attestation. It is not a certificate and it is not a pass or a fail. |
| Service organisation | The organisation that provides the service and is examined: your company. |
| Customer (user entity) | A customer that uses the service and relies on the report. Also written as “customer” in this pack. |
| CPA firm (service auditor) | The licensed CPA firm that examines management's description and the controls, and issues the report. Also “the CPA firm” and “the auditor” in this pack. |
| System | The service, and the infrastructure, software, people, procedures and data that provide it. The report is about one system, not the whole company. |
| Trust Services Criteria | The AICPA's criteria for a system, in five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. The AICPA calls the criteria CC1 to CC9 the common criteria. They apply to all five categories, so a report on any category includes them: the Security category is the common criteria. |
| Category | One of the five groups of criteria. A report covers Security and any of the others you choose. |
| Type 1 report | A report on the description and the design of the controls as of one date. |
| Type 2 report | A report on the description and on the design and operating effectiveness of the controls throughout a period, with the auditor's tests and results. |
| Observation period | The period a Type 2 report covers, from its first day to its last. Also “the period”. |
| Subservice organisation | A provider that runs part of the system for you, such as hosting. Not every supplier is one: only those whose controls matter to the criteria. |
| Carve-out method | The method that leaves the subservice organisation's controls out of the description and the tests, and states the controls assumed of it. |
| Inclusive method | The method that includes the subservice organisation's relevant controls in the description and the tests. It needs the provider's agreement: its controls are tested and it becomes a responsible party, so the CPA firm must be independent of both (the AICPA's SOC 2 guide, paragraphs 2.14 and 2.17). It is available only where the provider cooperates. |
| Bridge letter | A letter from your management that covers the interval after a report period ends. The CPA firm does not issue it, performs no procedures on the interval and gives no assurance over it. Market practice, not an AICPA document. |
| Readiness | Management's own check of the system, the controls and the evidence before the observation period starts. It is not the auditor's work and it is not an opinion. |
| Report-type row (RT-n) | One of the 5 rows of the decision table. Rows are read in order and the first that matches the answers decides the report type. |
| Prompt (PR-n) | One of 14 things to settle next. A prompt appears when its condition holds. It is not a finding. |
| Market practice | A length of time or an order of work that advisory sources call usual. It is not a rule of the AICPA, and the CPA firm and your customers decide what they accept. |
| House default | A number this pack suggests where no rule gives one, such as the time allowed to issue a report. Change it to what your CPA firm tells you. |
| EXAMPLE | A worked example: a US software-as-a-service provider with about 400 staff, selling to businesses that ask for a SOC 2 report, assessed as at 2026-09-30. Clear it before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 4.1 — Understanding the organization and its context | The whole workbook: the organisation's context, including the customers and the service the report is for |
| ISO/IEC 27001:2022 | Clause 4.2 — Understanding the needs and expectations of interested parties | Questions SQ-01 and SQ-04 to SQ-09: what customers and other interested parties require of the organisation |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole workbook: legal, regulatory and contractual requirements understood and recorded, as the customer's request for a report is |
| AICPA, SOC 2 | AICPA Trust Services Criteria (TSP section 100), introduction: a Type 2 SOC 2 report gives an opinion on the suitability of design and operating effectiveness of controls throughout a specified period and describes the tests and results; a Type 1 report addresses the same subject matter without an opinion on operating effectiveness or a description of tests, and is as of a specified date. The Journal of Accountancy (2016, an AICPA publication) gives the same split for SOC 1 and says SOC 2 reports come in both types. Neither source states a minimum period | SQ-01 to SQ-05, rows RT-1 to RT-5: the two report types and the difference between them |
| AICPA, SOC 2 | Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022): five categories. Security is the category whose criteria, CC1 to CC9, are the “common criteria”: they apply to every report, and a complete set of criteria is the common criteria plus those of each other category chosen. (CC2 is titled Information and Communication in the 2022 edition; earlier editions print Communication and Information.) The criteria number 61: 33 Security, 3 Availability, 2 Confidentiality, 5 Processing Integrity and 18 Privacy. Cited by number and series title only; the statements are in the Library | SQ-06 to SQ-09 and the category table: the five categories and the number of criteria in each |
| AICPA, SOC 2 | Where a service organisation uses a subservice organisation, the description uses either the carve-out method (the subservice organisation's relevant controls are left out of the description and the tests, and the description names the controls it assumes the subservice organisation operates) or the inclusive method (those controls are included). Management chooses for each subservice organisation. DC 7 in DC section 200 (read 20 October 2026) says what the description discloses under each method: under the inclusive method the nature of the service, the necessary controls, the relevant aspects of the subservice organisation's system and the portions attributable to it; under the carve-out method the nature of the service, the criteria intended to be met by the subservice organisation's controls and the types of controls assumed (CSOCs). The AICPA's SOC 2 guide (October 2022, read on 20 October 2026) adds that the inclusive method needs the subservice organisation's agreement, that its controls are subject to the service auditor's procedures, and that it makes the subservice organisation a responsible party, so the CPA firm must be independent of both (paragraphs 2.14 and 2.17); the text of the attestation standards was not read | SQ-10 and SQ-11, prompts PR-2 and PR-3: the carve-out and inclusive methods |
| AICPA, SOC 2 | The use of a SOC 2 report is restricted to specified parties with sufficient knowledge and understanding of the service organisation's system (Journal of Accountancy, February 2026, an AICPA publication). A SOC 3 report gives an opinion on operating effectiveness without the detailed tests and its use is not restricted (Trust Services Criteria introduction; Journal of Accountancy, 2016). Who may receive a SOC 2 report is for the CPA firm to state, and the report itself says it. A confidentiality agreement is common practice, not an AICPA rule | SQ-13 and prompt PR-4: the restricted use of a SOC 2 report and the report for general use |
| AICPA, SOC 2 | The AICPA's SOC 2 guide (October 2022, read on 20 October 2026 in the free PDF on the AICPA site) sets no minimum observation period for a Type 2 report. It says (paragraph 2.54) that for a period of less than two months a service auditor may conclude that sufficient evidence is unlikely, and that for nine months it is likely, and it leaves the decision to the CPA firm. Three, six and twelve months are what advisory sources call common, and customers set their own expectations. This is market practice, and the pack prints it as market practice, not as a rule of the AICPA. The CPA firm agrees the period in the engagement letter | SQ-04 and SQ-05, the Result sheet: the period, which is market practice and not a rule |
Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.
A reference says what its source describes and which CISO Times document helps with that work. It does not say that a document from this pack meets a criterion, and it does not say that an organisation will receive an unqualified opinion.
Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.
The Trust Services Criteria and the description criteria are published by the AICPA for CPAs who examine a service organisation. Nothing in law makes a SOC 2 report mandatory. A customer's contract, a procurement policy or an investor can ask for one, and the organisation chooses whether to commission an examination. The report is a CPA firm's opinion about the organisation's description and its controls. It is an attestation, not a certificate, and nobody is “SOC 2 certified” or “SOC 2 compliant” by holding one.
The observation period lengths, the three-month limit of a bridge letter, the order of the steps and the sample of questions for a CPA firm are market practice and house defaults. They are not rules of the AICPA, and the CPA firm and your customers decide what they accept.