SOC 2

1. 2026-10-31 Info
   AICPA publishes Proposed 2027 SOC 2 Trust Services Criteria and expands guidance on SOC services

   The AICPA has expanded its SOC suite resources page with several new materials, including Proposed 2027 SOC 2 Trust Services Criteria exposure drafts, ethics staff insights …

   Draft consultation

1. 2022-10-15 AICPA SOC 2 guide updated for SSAE No. 20 and 21, the 2017 criteria with 2022 points of focus and the 2018 description criteria with 2022 guidance

1. —
   2017 Trust Services Criteria (With Revised Points of Focus – 2022) RevisionCurrent

   The 2017 Trust Services Criteria with points of focus revised in 2022; the criteria cover security, availability, processing integrity, confidentiality and privacy. source

SOC 2 is a CPA's examination of a service organization's controls, often requested by its customers and business partners.

Who asks for it

Customers and business partners of a service organization often request a SOC 2 report to assess the risks of outsourcing to it. source

Categories

Controls are evaluated against criteria for security, availability, processing integrity, confidentiality and privacy. source

Scope

The criteria can be applied to an entire entity, or to a subsidiary, division or other part of it. source

SOC 3

A SOC 3 report is a general-use report on the same categories, covered by the same AICPA guide. source

A CPA examines management's description of the system and its controls and issues a SOC 2 report.

Examination

A SOC 2 engagement is an assertion-based examination of a service organization's description of its system and of its controls relevant to the five categories. source

Criteria used

The CPA uses the 2017 Trust Services Criteria to evaluate controls and the 2018 description criteria to evaluate management's description of the system. source

Who performs it

CPAs in public practice perform SOC 2 and SOC 3 examinations. source

The AICPA acts on the quality of the CPAs who perform SOC engagements.

Auditor quality

Responding to allegations about a SOC compliance vendor, the AICPA said it will act with respect to its members if auditors are found not to have performed audits under professional standards, not to be enrolled in peer review or to be unlicensed. source

Referrals

The AICPA assists government regulators, including referrals to state boards of accountancy, about unlicensed firms and practitioners. source

1. Standard 2017 Trust Services Criteria (With Revised Points of Focus – 2022)
2. Guidance SOC 2® Reporting on an Examination of Controls at a Service Organization (AICPA guide, October 2022)
3. Guidance System and Organization Controls: SOC Suite of Services

1. ISO 27001

   ISO/IEC 27001 certifies an information security management system; SOC 2 is a CPA's report on a service organization's controls against the Trust Services Criteria.

2. PCI DSS

   PCI DSS is required by payment brands for card data; SOC 2 is requested by customers to assess a service provider's controls.

3. FedRAMP

   FedRAMP certification is required for cloud services used by federal agencies; SOC 2 is a commercial attestation report.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to SOC 2 (RSS)