Tools · SOC 2 Report Readiness
Which SOC 2 report do we need?
Answer 13 questions about what your customers ask for, how long your controls have run, your date and your providers. You get a report type (Type 1, Type 2 or neither yet), the observation period, the categories and what to settle next. It is guidance for planning, not an audit decision. Nothing is stored.
Question 1 of 13 0 answered
Part 1 of 3
What is asked, and when
What the customer wants, how long your controls have run, and the dates.
Gather the facts first: the customer requests and contracts that mention SOC 2, the service levels and other written commitments you make, the list of providers that run parts of the service, the date each customer needs the report, and any minimum length of period a customer states. The Examination owner (name; often the Head of Information Security or a compliance lead) owns the assessment. The Executive sponsor decides scope questions that cost money. Legal reads the contracts.
What is asked, and when
The categories
The system and its providers
You can move on with questions unanswered: the result says which it still needs. Nothing is saved, so reloading the page starts again.
- About 10 minutes
- Nothing is stored, not even in your browser: reloading starts again
- If you accepted analytics, we count how far people get through the questions, never what they answer.
- Also as a workbook: SOC 2 Report Scoping Assessment
How this is worked out, and what it is not
- There are 5 rows. They are read from the top, and the first row that matches your answers decides the report type. The last row matches when none of the rows above it does.
- For a Type 2 report the observation period is the longest of 3, 6 and 12 months that still fits your date once 2 months for the CPA firm to issue the report are added. These lengths are market practice and the 2 months is a house default. Neither is a rule of the AICPA. With no date set the longest is used, and if no length fits the shortest is used and the result says that it does not fit. The period is counted from today: if your controls have run for under 3 months, add the weeks until they have run for 3 months (SR-10). The date question asks for a range and the method reads the far end of it, so if your date is near the earlier end, answer with the earlier range. If a customer states a minimum that is longer than the period that fits, the minimum is used, and the result says whether that still fits your date.
- If the report type is Type 1, then Type 2, your date is too close for a Type 2 report to be issued. The Type 2 period that follows is 6 months (a house default), or the customer's minimum if that is longer. For Get ready first and for a Type 1 report there is no observation period to choose here.
- Security is always in scope, because its common criteria are part of a report on any category. Another category is added only when you answer that a customer or contract requires it or that you make a written commitment. The criteria in scope are the Security criteria plus those of each other category chosen, so a report on Availability alone has the Security criteria and the Availability criteria: Security 33, Availability 3, Confidentiality 2, Processing Integrity 5, Privacy 18.
- The 14 prompts PR-1 to PR-14 are the things to settle next. Each appears when its condition holds, as the rules set out.
The result is a statement of what applies, in the workbook's words, never a score. The questions, the answers to choose from and the rule are the workbook's: the same answers give the same result in both. It is not legal advice.
- This result is guidance for planning. It is guidance, not an audit decision, and it is not an opinion. Only a licensed CPA firm can examine your description and controls and give an opinion, and the firm decides what it will examine and how the report reads.
- No report type is a certification: a Type 1 report and a Type 2 report are both attestations by a CPA firm.
- A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.
- Confirm the report type, the categories and the dates with the CPA firm before you commit to a customer, and agree the observation period in writing with the firm (SR-16). The customer decides which report it accepts.
- Rule SR-22: "ISO/IEC 27001 certification and a SOC 2 report are different things, from different bodies, about different subjects. Neither equals or replaces the other. Say what you hold and let the customer decide what it accepts (P08, P26)."
- The period lengths, the allowance of 2 months to issue the report, the 3 months of operation before a first Type 2 period and the 3 months a bridge letter usually covers are market practice and house defaults. They are not rules of the AICPA.
- This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.