Security
Protect information and systems against unauthorized access, use, or change that could compromise the service. For a small team, examples to review may include account access, authentication, change processes, and incident handling.
RULEWELD / PRACTICAL GUIDE
SOC 2, made clearer.
A practical orientation for small companies deciding what to scope, prepare, and ask an independent CPA firm.
THE STARTING POINT
SOC 2 is an independent examination of a defined system.
SOC 2 is an attestation engagement performed by an independent CPA firm. The report describes a service organization’s system, the Trust Services Criteria included in scope, and the auditor’s examination. It is not a universal checklist: the system, services, commitments, risks, and customer needs help determine the appropriate scope. Some or all of the five criteria may be included; the report should make clear which ones the examination covers. AICPA: SOC services·AICPA: Trust Services Criteria
THE TRUST SERVICES CRITERIA
Five areas, selected for the system in scope
The engagement may cover one or more of these criteria, depending on the system and its commitments. A practical scoping conversation often starts with security, then checks whether the other areas matter to the service. These short descriptions are orientation, not control requirements.
Availability
Address whether the system is available and usable as committed or agreed. It does not mean every system must promise a particular uptime; scope depends on service commitments. Consider monitoring, backups, recovery, and incident communication.
Processing Integrity
Consider whether system processing is complete, valid, accurate, timely, and authorized, as applicable to the service. This can matter when customers rely on the system to process transactions, calculations, or other important information.
Confidentiality
Protect information identified as confidential according to the organization’s commitments. It concerns designated confidential information; it is not the same as the Privacy criterion, which addresses personal information.
Privacy
Address how personal information is collected, used, retained, disclosed, and disposed of under the organization’s privacy notice and commitments. Including this criterion does not by itself establish compliance with privacy laws.
A PRACTICAL FIRST PASS
Put the work in a manageable order
These are planning prompts, not a complete checklist or a guarantee of readiness. Adapt them with customers and a qualified CPA firm to your actual service.
Define the service and system boundary
Write down which product or service is in scope, how customers use it, and which people, processes, infrastructure, data, and vendors support it. Record what is outside the boundary too, so the scope can be explained and reviewed.
Choose criteria from commitments and risk
Begin by reviewing security needs. Ask what customers expect about uptime, transaction processing, confidential information, or personal information before selecting criteria. Compare contracts, public commitments, and actual data flows with an independent CPA firm; do not include a criterion just because another company did.
Assign owners to the controls you rely on
Identify risks and decide who owns the responses. Common topics to discuss include joiner and leaver access, periodic access review, production changes, incident response, vendor oversight, and recovery planning. The right practices depend on the scoped system and commitments; there is no single small-company checklist.
Keep evidence while the work happens
Save dated records that show how a control operated, such as approvals, access reviews, incident follow-up, or recovery tests when those activities are in scope. Keep the evidence connected to its owner, system, and period. A policy document alone may not show that a process was followed.
Agree on report scope and timing with the CPA firm
Ask what the examination covers, which criteria and systems are included, what evidence will be requested, and how the report may be shared. Discuss Type I or Type II based on customer needs and your controls’ maturity. Avoid promises of a guaranteed clean opinion or a fixed timeline before the facts are assessed.
UNDERSTAND THE DELIVERABLE
An attestation report, not a certification
SOC 2 is not a certification that awards a pass/fail credential. The deliverable is an attestation report from an independent licensed CPA after an examination. Readers assess the report’s opinion, scope, period, and any exceptions in context. AICPA vice president: why SOC 2 is not a certification
Controls at a point in time
A Type I report addresses the system description and whether controls were suitably designed as of a specified date. It does not cover whether those controls operated effectively over an extended period.
Controls over a period
A Type II report also addresses whether controls operated effectively throughout a specified period, based on the auditor’s tests and results. The period and coverage are stated in the report; customers may have their own expectations.
A SOC 2 report is usually a detailed document shared with intended users under appropriate restrictions, rather than a public certificate. A sample report helps show its form and contents. View the AICPA illustrative report (member access)·Journal of Accountancy: attestation context
CHECK THE PRIMARY MATERIAL
Sources and authority
Use the AICPA material for the criteria and SOC report context. The Journal of Accountancy article is explanatory professional coverage, not the standard itself.
AUTHORITATIVE CRITERIA
AICPA Trust Services Criteria
The 2017 Trust Services Criteria with revised points of focus issued in 2022. Refer to the original criteria and related AICPA guidance for examination details.
Read the AICPA criteriaSOC REPORT MATERIAL
AICPA SOC resources
This guide is educational information only, not legal advice or auditor advice. It does not evaluate your organization, establish that any criteria or control applies, or guarantee SOC 2 compliance, readiness, or an audit result. Confirm scope and requirements with an independent CPA firm and qualified legal or security advisers for your situation.
Browse the Ruleweld SOC 2 starter catalog·Read the Ruleweld GDPR guide·Read the Ruleweld HIPAA guide