SOC 2

Service Organization Control Type II — an auditing standard that evaluates a service provider's controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 is an auditing framework that examines a service provider's controls across trust principles, and a current Type II report is the most widely used evidence of enterprise security maturity. For buyers, SOC 2 matters because it replaces some guesswork: an independent auditor tested whether controls exist and operated over a period, covering areas like access management, monitoring, change management, and incident response. Report reviews should verify scope, that the report covers the services being purchased, and that the relevant trust criteria match organizational risk. A report is a snapshot, so buyers should confirm the audit cadence and review the current period. Organizations should also check complementary user entity controls, which shift some responsibilities onto the customer. SOC 2 evidence supports vendor due diligence but should accompany, not replace, direct security questions.