[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is SOC 2?](/blog/soc-2) Publish date October 26, 2026 {x} minute read # What is SOC 2? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Service Organization Control 2 (SOC 2) is an auditing standard and readiness assessment developed by the American Institute of Certified Public Accountants (AICPA). It is designed to ensure service providers and third-party vendors protect sensitive data and personal information from unauthorized access. SOC 2 audit reports cover a period (generally 12 months) and include a description of the service organization's system, and test the design and operating effectiveness of key internal controls over a period of time. [Information security](https://www.upguard.com/blog/information-security) and [defense-in-depth](https://www.upguard.com/blog/defense-in-depth) are important in any organization. The rise of outsourcing key business operations (SaaS companies, their products, and other data center providers) means more third and fourth-party [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak) are happening. Additionally, the [cost of data breaches](https://www.upguard.com/blog/cost-of-data-breach) and regulatory scrutiny (due to laws like [HIPAA](https://www.upguard.com/blog/how-to-become-hipaa-compliant) and [GDPR](https://www.upguard.com/blog/how-to-be-gdpr-compliant)) has never been higher, necessitating the importance of [data security](https://www.upguard.com/blog/data-security) controls. The purpose of SOC 2 is to provide peace of mind for organizations when they engage third-party vendors. This has led many security-conscious organizations to look for SOC 2 compliance as part of their vendor assessment process to reduce vendor [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk). ## Why is SOC 2 Compliance Important? Outsourcing and, in turn, third-party and [fourth-party risk](https://www.upguard.com/blog/what-is-fourth-party-risk) have never been higher. Every organization is outsourcing parts of its operations, often to multiple suppliers. Those suppliers are then outsourcing part of their operations to other suppliers. This is why SOC 2, a [Third-Party Risk Management framework](https://www.upguard.com/blog/third-party-risk-management-framework), and a [Vendor Risk Management](https://www.upguard.com/blog/vendor-risk-management) program, and general strong security practices are so important. [Vendor risk](https://www.upguard.com/blog/vendor-risk-impact-of-data-leaks-by-your-third-party-vendors) needs to be managed carefully with [vendor questionnaires](https://www.upguard.com/blog/planning-your-vendor-security-assessment-questionnaire), [security ratings](https://www.upguard.com/blog/what-are-security-ratings), and industry benchmarking. You can read our [Third-Party Risk Management buyers guide](https://www.upguard.com/resources/buyers-guide-to-third-party-risk-management) to learn more. The most important thing to understand is customers don't care whether [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak) are the results of your mismanagement of their data or your vendor's mismanagement. They care that their data was exposed or sold on the [dark web](https://www.upguard.com/blog/dark-web). Consider making SOC 2 compliance part of your [information security policy](https://www.upguard.com/blog/information-security-policy) and [cyber security risk assessment](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) process. Meeting SOC 2 compliance requirements is one way to determine whether your vendors are implementing secure data protection and data processing protocols. Along with looking for SOC 2 compliance, consider investing in a tool that can [automatically monitor your vendors’ security performance and automate security questionnaires](https://www.upguard.com/product/vendorrisk). Better yet, look for a tool that is [CVE](https://www.upguard.com/blog/cve) compatible. And look for shared assessments that allow your organization to obtain a detailed report about your service provider's controls and verify that the information in the report is accurate. [Digital forensics](https://www.upguard.com/blog/digital-forensics) isn't always going to give you anything useful, and even if it does, police cyber attacks can be hard due to their distributed nature. It's far better to prevent a data breach than try to clean one up after the fact. As many organizations have found out, once data is exposed, it can prove difficult to recover. [Learn how to prepare for a SOC audit >](https://www.upguard.com/blog/unprepared-for-soc-audit) ## What is SOC 2 Compliance? The Trust Services Criteria (TSC) SOC 2 compliance is concerned with how companies manage and store customer data in accordance with AICPA's five Trust Services Criteria (TSC): 1. **Security: **The protection of system resources from unauthorized access. This could include [network security](https://www.upguard.com/blog/network-security), [intrusion detection](https://www.upguard.com/blog/top-free-network-based-intrusion-detection-systems-ids-for-the-enterprise), and other security tools that protect against [vulnerabilities](https://www.upguard.com/blog/vulnerability), [ransomware](https://www.upguard.com/blog/ransomware) like [WannaCry](https://www.upguard.com/blog/wannacry), and other [types of malware](https://www.upguard.com/blog/types-of-malware). These criteria are concerned with reducing [cyber threats](https://www.upguard.com/blog/cyber-threat) and [preventing data breaches](https://www.upguard.com/blog/prevent-data-breaches) and [cyber attacks](https://www.upguard.com/blog/cyber-attack). 2. **Availability: **The accessibility of the system, products, or services stipulated in a contract or by service level agreement (SLA). It does not address system functionality and usability but rather security-related criteria that can affect availability.**** 3. **Processing integrity:** Addresses whether a system achieves its purpose in a complete, valid, accurate, timely, and authorized manner. 4. **Confidentiality: **Addresses whether [sensitive data](https://www.upguard.com/blog/sensitive-data) is restricted to specific people or organizations. [Encryption](https://www.upguard.com/blog/encryption), [phishing](https://www.upguard.com/blog/phishing) awareness training, [SSL certificates](https://www.upguard.com/blog/ssl-certificate), [DNSSEC](http://dnssec%2C/), and preventing [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack), [domain hijacking](https://www.upguard.com/blog/domain-hijacking), and [email spoofing](https://www.upguard.com/blog/email-spoofing) are fundamental to protecting confidentiality. 5. **Privacy: **Addresses the collection, use, retention, disclosure, and disposal of [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) and how it aligns with the organization's privacy notice and criteria set out in AICPA's generally accepted privacy principles (GAPP). All PII must be protected from exposure, both accidental and deliberate. Examples of PII data include phone numbers, names, and social security numbers. Unlike stricter security standards like PCI DSS, SOC reports are unique to each organization. This means organization controls can be designed, in line with specific business practices, to comply with one or more of the trust services principles. These internal reports provide regulators, business partners, suppliers, and your organization with important information about how your service providers manage [sensitive data](https://www.upguard.com/blog/sensitive-data). Recieving a SOC report isn't the end of your SOC 2 compliance journey. To ensure you get as much value as possible from your SOC 2 investment, it's important to[ understand the next steps following a SOC 2 audit](https://www.upguard.com/blog/soc-2-audit-next-steps). ## What are the Different SOC Standards? The American Institute of CPAs (AICPA) has developed three SOC audit standards: * **SOC 1:** Evaluates, tests, and reports on the effectiveness of the service organization's internal access controls related to user entities' [internal controls over financial reporting](https://www.upguard.com/blog/sox-compliance). A SOC 1 report is equivalent to a Statement on Standards for Attestation Engagements (SSAE 16) report. * **SOC 2:** Evaluates, tests, and reports on the systems and organization controls related to storing information but is not significant to financial reporting or financial controls. SOC 2 was preceded by SAS 70. * **SOC 3:** Reports on the same details as a SOC 2 report but is intended for a general audience. They are shorter and do not include the same details as a SOC 2 report but are shared openly, often on a company's website with a seal to indicate compliance. ### What are the Different Types of SOC Reports? There are two types of SOC reports: 1. **Type I:** Describes a vendor's system and organization controls and whether they are suitable to meet relevant criteria. 2. **Type II:** Details the operating effectiveness of the systems outlined in Type I. A common misconception is to confuse SOC types with SOC standards. Each SOC standard (SOC 1, SOC 2, and SOC 3), can each have a SOC report of Type I or Type II, i.e. SOC 2 Type II. ## What is a SOC 2 Certification or Attestation? A SOC 2 certification is issued by an independent CPA firm and assesses the extent to which a vendor complies with one or more of the five trust principles based on the service organization's controls and processes. SOC 2 reports consist of the following: * The opinion letter * Management's assertion * Description of the system * Description of tests of controls and results of testing * Other information ## How UpGuard Helps Organizations Stay SOC 2 Compliant UpGuard can help organizations and businesses stay SOC 2 compliant by helping them focus on data security using our industry-leading [attack surface monitoring](https://www.upguard.com/product/breach-risk) and [vendor risk management](https://www.upguard.com/product/vendor-risk) software. SOC 2 security principles have a heavy focus into preventing unauthorized used of digital assets and data and requires organizations to implement access controls to prevent cyber threats, malicious attacks, [data theft](https://www.upguard.com/blog/data-theft), data leaks, and the intentional misuse or disclosure of company information. Additionally, UpGuard has [customizable questionnaire](https://www.upguard.com/product/security-questionnaires) templates that organizations can tailor to their vendors to properly assess security postures to stay SOC 2 compliant. The entire questionnaire process is automated to ensure an efficient and effective workflow. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)