What it is
SOC 2 is a framework from the American Institute of CPAs. An independent CPA firm audits a company’s controls against the Trust Services Criteria and issues a report. It’s not a certificate or a government requirement; it’s evidence a customer can read.
- Security (always included), plus optionally availability, processing integrity, confidentiality and privacy.
- Type I: the controls are designed properly at a point in time.
- Type II: the controls actually operated over a period, usually several months to a year. Customers usually want Type II.
Who needs one
- Software and service companies selling to larger businesses, whose security questionnaires ask for it.
- Vendors holding client data for regulated industries.
- Most local businesses don’t need their own SOC 2; they may need to ask their software vendors for theirs.
Getting ready
We run our own company to the SOC 2 Trust Services Criteria and collect evidence weekly. We’re not SOC 2 certified, and we say so; our security page shows what we do.
- Written policies people actually follow: access, incident response, vendor management, change management.
- Two-step sign-in and least-privilege access everywhere.
- Logs and evidence collected continuously, not the week before the audit.
- Risk assessments and reviews on a schedule.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.