SOC 2
Also known as: SOC2 · SOC 2 Type II report · Service Organization Control 2
SOC 2 is an attestation report produced by an independent accounting firm, describing a service company's controls and the auditor's opinion on their effectiveness.
Two forms exist: Type I attests that controls are suitably designed at a point in time; Type II that they operated effectively over a period, usually several months. The difference in value between them is considerable.
It is not a certification but an attestation: what is sold is the professional opinion of a named auditor, who stands behind it. That signature is what gives the document its value, not the template.
The full report is confidential and circulates under non-disclosure; what is shared openly is a summary.
What it means for a small business
It is the document large-company procurement asks for by reflex. Its cost puts it out of reach for a young company, which leaves a gap: proving something verifiable before you can afford a full audit.
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.