SOC stands for System and Organization Controls. A SOC 2 report is an attestation: an independent CPA firm examines a service organization's description of its system and its controls, then issues an opinion. The criteria it examines against are the AICPA's Trust Services Criteria. Nobody passes or fails SOC 2 in the way people pass an exam. The output is a report that customers read and judge for themselves.
Report, not certificate
Because SOC 2 is an attestation engagement, the correct language is that a company has a SOC 2 report with an unqualified (clean) or qualified opinion. The phrase SOC 2 certified is common in marketing but technically inaccurate. The distinction matters in procurement: a buyer usually wants the report itself, under NDA, and will read the exceptions, not just a badge on a website.
What is inside a SOC 2 report
Section order and naming vary slightly between audit firms, and some reports add an optional section of unaudited information from management. The complementary user entity controls are worth reading carefully: they list what the customer is expected to do for the controls to work.
Type I or Type II
SOC 1, SOC 2, and SOC 3
- SOC 1 addresses controls relevant to a customer's internal control over financial reporting, such as a payroll processor.
- SOC 2 addresses security and, optionally, availability, processing integrity, confidentiality, and privacy. Distribution is restricted to parties with sufficient knowledge to understand it, which is why it is shared under NDA.
- SOC 3 covers the same criteria as SOC 2 but is a short, general-use report without the detailed test results, so it can be published openly.
Where to go next
This entry sticks to the definition. The SOC 2 framework page covers scoping, control coverage, and the path to a report, and the SOC 2 readiness use case walks through preparation. If you are weighing SOC 2 against an international standard, read ISO 27001 vs SOC 2.