SOC 2: AICPA Trust Services Criteria
An attestation shaped in North America and increasingly demanded internationally as proof of a service provider's trustworthiness — especially relevant for SaaS vendors with US customers or international enterprise contracts.
An attestation by an accounting firm, not a certificate.
SOC 2 is based on the Trust Services Criteria (TSC) of the American Institute of Certified Public Accountants (AICPA) — the 2017 version, with revised Points of Focus from 2022. Unlike ISO/IEC 27001, SOC 2 is not a certificate but an attestation report produced by a licensed CPA firm.
The TSC are organised into five categories: Security (the mandatory "Common Criteria", CC1–CC9) plus four optional additional categories — Availability, Processing Integrity, Confidentiality, and Privacy — freely selectable depending on the business model.
SOC 2 has two report types: Type I assesses the suitability of controls at a point in time; Type II assesses their actual operating effectiveness over an observation period — in practice usually six to twelve months. Type II is considered the more informative report and the one more in demand in the market.
Key deadlines
AICPA Trust Services Criteria (2017)
Current base version of the Trust Services Criteria that SOC 2 reports are built on.
Revised Points of Focus 2022
Revised interpretive guidance (Points of Focus) for the 2017 TSC, without changing the criteria themselves.
Assessment of control suitability at a point in time
A point-in-time assessment of whether the described controls are suitably designed.
Assessment of operating effectiveness over a period
The observation period is not fixed by the AICPA, but in practice usually runs six to twelve months; an annual renewal cycle is then the market norm.
How SOC 2 is structured.
Security / Common Criteria (CC1–CC9)
The mandatory baseline criteria for every SOC 2 report: governance, risk assessment, control activities, communication, monitoring.
Four optional categories
Availability, Processing Integrity, Confidentiality, and Privacy — selectable in addition to Security depending on business model and customer expectations.
Type I vs. Type II
Type I: suitability of controls at a point in time. Type II: proven effectiveness over an observation period — more informative, more effort.
Annual attestation cycle
SOC 2 reports have no fixed statutory validity period, but are overwhelmingly renewed annually in the market to demonstrate ongoing currency to customers.
Common Criteria evidence, cross-mapped to NIS2 and ISO 27001.
The ReportAct SOC 2 Framework Pack maps all nine Common Criteria categories (CC1–CC9) as a structured assessment — fully cross-mapped to NIS2 and ISO/IEC 27001, so the same control doesn't need to be captured three times.
The sealed evidence from ReportAct serves as the basis for your auditor when producing the SOC 2 report — particularly for Type II, where operating effectiveness must be traceably documented across the entire observation period.
Via the Trust Center, sealed SOC 2-relevant evidence can be used directly in customer questionnaires and in the public trust proof — without manual rework for every request.
Product/positioning statement, not legal advice.
Read the originals
ReportAct is not a consultancy. This page does not constitute legal advice. The text of the Trust Services Criteria is copyrighted and available from the AICPA — this page describes structure and process but does not replace reading the original text or coordinating with your auditor. Our Terms of Service apply.
Evidence that speeds up your SOC 2 audit.
Start right away with your Common Criteria assessment — cross-mapped to NIS2 and ISO 27001.