# What is SOC 2? SOC 2 is a CPA's examination of a service company's system description and controls, measured against the AICPA's trust services criteria. Updated: October 16, 2026 SOC 2 is an examination in which a certified public accountant (CPA) reports on a service company's description of its system and on its controls. The criteria come from the American Institute of CPAs (AICPA). The AICPA's guide for these engagements covers controls relevant to "security, availability, processing integrity, confidentiality, or privacy." Software vendors and other service companies get one because their customers ask for it. ## Who asks for a SOC 2 report? The AICPA's guide says customers and business partners usually need to know how a service company's controls are designed and whether they work. To get that information, it says, they often ask the company for its SOC 2 report. One report answers those questions for every customer who reads it, instead of each customer checking your controls on its own. ## Which criteria does the CPA use? There are two sets. The trust services criteria are control criteria set by the AICPA's Assurance Services Executive Committee. The AICPA calls them "outcome-based criteria," meant for judging whether a system and its controls are effective. In other words, they state what your controls should achieve and leave the method to you. The current version is the 2017 trust services criteria with revised points of focus from 2022. The second set is the 2018 description criteria. The AICPA calls them benchmarks for preparing and judging the description of your system. That description is the part of the report where you say what the system is and what it includes. ## How do Type 1 and Type 2 differ? A Type 1 report looks at controls as of one date. At an AICPA conference, a CPA on a panel put it this way: "For a type 1, the service auditor is evaluating controls as of a specific date." A Type 2 report adds testing. The AICPA's sample Type 2 report has four parts: management's assertion, the description of the system, the auditor's report, and the auditor's tests of controls with their results. The AICPA's separate sample auditor's report follows SSAE 21, the attestation standard for reports dated on or after June 15, 2022. In a Type 2, the auditor tests whether controls actually ran, and a list put together the week before the audit can't show that. So keep records as you go. The same AICPA guide also covers SOC 3, a report meant for general use. ## What to have ready about account access Decide early which systems your description will cover, and confirm the scope with your auditor. Once the scope is set, keep four records for each login to a system in it: who can use it, who approved that, when each person's access was removed, and who used the login and when. A [shared account](/guides/shared-accounts/what-is-shared-account) makes the last two hard, because the login's history shows one name for everyone who knows the password. If you run clients' accounts as an agency, [How client accounts fit into your agency's SOC 2 audit](/guides/agency-accounts/soc-2-audit-client-accounts-for-agencies) covers what clients and auditors ask. If you want a free public framework to plan against, see [How NIST CSF 2.0's PR.AA applies to shared accounts](/guides/compliance/nist-csf-2-identity-management). ## Frequently asked questions **Is SOC 2 a certification?** The AICPA calls it an examination. A CPA examines your system description and your controls and issues a report, and each customer reads that report and draws its own conclusions. **What's the difference between a SOC 2 Type 1 and Type 2 report?** A Type 1 looks at controls as of one date. A Type 2 report also contains the auditor's tests of controls and their results, so it says more about whether the controls actually ran. **Which version of the criteria is current?** The 2017 trust services criteria with revised points of focus from 2022, used with the 2018 description criteria for the system description. **When should we start keeping records for a Type 2?** As soon as you know which systems your description covers. In a Type 2, the auditor tests whether controls actually ran, and records put together just before the audit can't show that. ## Sources - [AICPA & CIMA, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (guide, updated October 15, 2022)](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) - [AICPA & CIMA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022), download page](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) - [AICPA & CIMA, Get mappings relevant to the trust services criteria](https://www.aicpa-cima.com/resources/article/get-mappings-relevant-to-the-soc-suite-of-services) - [AICPA & CIMA, 2018 SOC 2 Description Criteria (With Revised Implementation Guidance, 2022)](https://www.aicpa-cima.com/resources/download/get-description-criteria-for-your-organizations-soc-2-r-report) - [AICPA & CIMA, Illustrative SOC 2 Report with Illustrative System Description](https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion) - [AICPA & CIMA, Illustrative Service Auditor's SOC 2 Type 2 Report](https://www.aicpa-cima.com/resources/download/illustrative-service-auditors-soc-2-r-type-2-report) - [AICPA & CIMA, Maintaining high standards for SOC engagements (December 6, 2023)](https://www.aicpa-cima.com/professional-insights/video/maintaining-high-standards-for-soc-engagements) ## How Junify handles this **Doing this by hand** You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change. **With Junify** For each login you add, Junify keeps the list of who may use it. Each sign-in is recorded under the person who verified on their own phone, shared logins included. Change each password when you add it, so only Junify holds it. Nobody is told the password, so once you remove someone in Junify, they can't sign in again. The record exports as CSV. Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when. - [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=compliance&slug=what-is-soc2) - [Book a 30-minute demo](https://www.junify.com/bpo/demo) ## More on this topic - [What access logs need to show when you decide whether to report a breach](/guides/compliance/breach-notification-access-logs): Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise. - [Password sharing and the federal anti-hacking law (CFAA)](/guides/compliance/cfaa-password-sharing): The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization. - [What CIS Controls 5 and 6 (v8.1) ask of your accounts](/guides/compliance/cis-controls-account-access-management): Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.