Skip to main content

← Back to glossary

Term · 14. International Standards

SOC 2 (System and Organization Controls 2) SOC 2

Standard Source: AICPA SOC 2
Personal Data Identity Security Standards SOC 2

Definition

AICPA auditing framework for service organizations, evaluating controls relevant to five Trust Services Criteria: Security (common criteria, required), Availability, Processing Integrity, Confidentiality, and Privacy. SOC 2 Type 1 attests to control design at a point in time; SOC 2 Type 2 attests to operating effectiveness over a period (typically 6-12 months). De-facto baseline for SaaS vendor due diligence.

Synonyms
  • AICPA SOC 2
  • Trust Services Criteria
Discouraged variants
  • SOC1 (different scope — financial reporting controls)
Application
Required by enterprise customers before procurement of SaaS. IDM/IAM impact: documented identity lifecycle (JML), provisioning workflows, access reviews, MFA enforcement, privileged account monitoring, audit logs of all identity events. Auditors verify these via interview, sampling, and walkthroughs.
Sources

Related terms

← Back to glossary  ·  Open in main list