What SOC 2 is
SOC 2 (System and Organization Controls 2) is a US attestation report, performed by a licensed CPA firm, on how a service organization manages data against the AICPA's Trust Services Criteria. It is one of the most common security assurances requested in B2B sales.
The Trust Services Criteria
Security is always included; you can add Availability, Processing Integrity, Confidentiality, and Privacy depending on the commitments you make to customers. You scope the report to the criteria that matter for your service.
Type I vs Type II
A Type I report assesses whether your controls are designed appropriately at a single point in time. A Type II report assesses whether those controls also operated effectively over a period — typically three to twelve months. Customers usually want Type II.
Who needs it
SaaS and service providers whose customers need assurance about how their data is handled — often a requirement to close enterprise deals.
How to prepare
Define your scope and criteria, implement the controls, run them through the observation period while collecting evidence, then undergo the CPA audit.
How muVerity helps
We get you ready, help implement and evidence controls, and coordinate the audit with your CPA firm.