Menu
On this page
- What Does “SOC 2 Compliance” Actually Mean?
- Why Is SOC 2 an Attestation, Not a Certification?
- What Do SOC 2 Claims Mean, and What Should a Buyer Ask For?
- What Term Should You Use?
- Can You Be SOC 2 Compliant Without a Report?
- Who Issues SOC 2 Reports, and What Do the AICPA’s Own Texts Say About Them?
- How Can a Buyer Verify a SOC 2 Claim?
SOC 2 compliance means an independent, licensed CPA firm (or a non-US equivalent) has examined a company’s controls against the AICPA Trust Services Criteria and issued a SOC 2 report with its opinion. There is no SOC 2 certificate and no certifying body, so “SOC 2 compliant” is shorthand for holding that report, and what it proves depends on the report’s type, period, scope, and opinion.
For the full process, cost, and timeline, see the SOC 2 compliance guide.
What Does “SOC 2 Compliance” Actually Mean?
SOC 2 compliance is shorthand for holding a SOC 2 report: a CPA firm’s examination of a service organization’s controls, performed under AICPA attestation standards. No body grants a compliance status. The report states an opinion, and the reader judges what that opinion covers.
SOC stands for System and Organization Controls, the AICPA’s suite of reports on controls at a service organization. The AICPA adopted that name in 2017; it was previously “service organization controls.” SOC 2, sometimes written SOC2, is the report on controls relevant to security, availability, processing integrity, confidentiality, or privacy. The Journal of Accountancy notes that “compliance” is a term SOC 2 examinations never use, which is why the word needs a definition each time it appears in a sales page or questionnaire.
| Short answer | |
|---|---|
| What it covers | One or more of five categories: security, availability, processing integrity, confidentiality, and privacy. See the Trust Services Criteria. |
| Type 1 | An opinion on whether controls are suitably designed at one date. |
| Type 2 | An opinion on design and operating effectiveness over a period, commonly 3, 6, or 12 months. See Type 1 vs Type 2. |
| Who issues it | An independent, licensed CPA firm (or a non-US equivalent), not a compliance platform. Compare firms in the SOC 2 auditor directory. |
| How long it counts as current | No fixed validity period. Schellman, a CPA firm, gives 12 months as the rule of thumb and says each customer decides. A bridge letter addresses the gap. |
| Who asks for it | Customers and procurement teams. It is not universally required by law. See who needs SOC 2. |
Why Is SOC 2 an Attestation, Not a Certification?
SOC 2 is an attestation engagement: a CPA firm examines a subject (the controls) against criteria (the Trust Services Criteria) and gives an opinion in a report. A certification is a certificate issued by a certification body, as with ISO 27001. SOC 2 has no certificate and no certifying body.
An adverse opinion still produces a SOC 2 report, so the outcome is a document to read rather than a status. The AICPA does offer a SOC logo that report holders can register to display. It signals that a report exists and is not a certificate; our SOC 2 logo guide covers the terms.
What Do SOC 2 Claims Mean, and What Should a Buyer Ask For?
Each of these phrases points to a document. “Certified” and “compliant” usually mean a SOC 2 report exists, and only the report shows its type, period, scope, and opinion. For each common claim, the table lists what should exist, what to ask for, and what an accurate seller says instead.
| What should exist | What a buyer asks for | A seller can say instead | |
|---|---|---|---|
| ”SOC 2 certified” | A SOC 2 report. No certificate exists. | The report, usually under NDA, and the name of the issuing CPA firm. | ”We have a SOC 2 Type 2 report from [firm] covering [dates]." |
| "SOC 2 compliant” | A SOC 2 report, or nothing. The examination itself does not use the word. | The report. With none, the claim is self-declared. | ”We hold a SOC 2 Type 2 report.” With no report: “We are preparing for SOC 2." |
| "SOC 2 Type 1” | A report on whether controls are suitably designed as of one date. | The as-of date, the systems in scope, the opinion, and when a Type 2 will follow. | ”SOC 2 Type 1 report as of [date]." |
| "SOC 2 Type 2” | A report on design and operating effectiveness over a stated period. | The period start and end dates, scope, opinion, listed exceptions, and any carved-out subservice organizations. | ”SOC 2 Type 2 report covering [start] to [end]. Opinion: [as issued].” |
| Qualified or adverse opinion | A report whose opinion is qualified or adverse, or one where the auditor disclaimed an opinion. It is still a SOC 2 report. | The opinion paragraph, the stated basis for it, and the controls affected. See exceptions and qualified opinions. | State the opinion as issued. Say “unmodified” (also called unqualified or clean) only if the opinion paragraph carries no qualification, adverse conclusion, or disclaimer. |
| ”SOC 2 ready” or “in progress” | Controls in place or an examination under way. No report yet. | The expected report date and the CPA firm doing the work. | ”We are preparing for our first SOC 2 report.” |
| An older report | A report whose period ended some time ago. | The period end date, a bridge letter, and when the next examination period began. | ”Our report covers [dates]. The next period began [date].” |
The opinion takes one of four forms: unmodified (also called unqualified or clean), qualified, adverse, or a disclaimer. An unmodified opinion says the controls were suitably designed and, for Type 2, operated effectively. The other three signal a problem a buyer should read about. Even an unmodified report can list test exceptions that do not change the opinion, so read the exceptions section either way.
What Term Should You Use?
In your own materials, name what you hold: report type, period, and issuing firm. “SOC 2 Type 2 report” or “SOC 2 attested” is accurate and needs no correction. When a buyer asks “Are you SOC 2 certified?”, answer the question they meant first, then give those facts.
A questionnaire answer can read: “Yes, we hold a current SOC 2 Type 2 report from [firm], covering [start] to [end]. The opinion is [as issued]. It is an attestation report rather than a certificate, and we share it under NDA.” On a website, in a contract, or in a security questionnaire, use “SOC 2 Type 2 report” and skip “certified.” In conversation, correcting the word rarely helps; stating the type, period, and opinion usually settles the question.
Can You Be SOC 2 Compliant Without a Report?
A company can run controls modeled on the Trust Services Criteria without any examination, but that is preparation, not an examination result. Nothing independent has tested those controls, so a buyer who needs assurance will ask for the report.
“Preparing for SOC 2” or “working toward our first report” says where a company stands. “SOC 2 compliant” without a report is a claim a buyer cannot check, and it tends to be read as having a report. Only a licensed CPA firm (or a non-US equivalent) can issue one.
Who Issues SOC 2 Reports, and What Do the AICPA’s Own Texts Say About Them?
A CPA firm (or, outside the US, an equivalent accountancy firm) issues a SOC 2 report, acting as the “service auditor,” and no certifying body is involved. Our directory lists 185 firms that can issue one. The AICPA’s SOC 2 Guide and attestation standards set how the examination is performed and reported. In the US, state accountancy law generally reserves SOC 2 examinations for licensed CPA firms, and state boards generally require those firms to undergo peer review. A report does not show either fact, so confirm both before you rely on it.
Counted by organization group, the directory lists 19 Big Four member firms, 105 other full-service CPA firms, and 61 assurance specialists. The Big Four figure counts member firms country by country, so it is not a count of four issuers. A full-service CPA firm does tax, audit, and advisory work, with SOC as one practice among several. An assurance specialist makes SOC and similar examinations its core business. The group describes how a firm is set up, not how good it is, and every group in the directory is made up of firms that can sign a SOC 2 report. Firms outside the US are included. Compare them, with the licence and peer review facts we have recorded for each US firm, in the SOC 2 auditor directory.
Two AICPA texts sit behind the table below: the SOC 2 Guide (2022 edition) and the attestation standards, AT-C sections 100 to 300 (2023 edition).
| Question | What the AICPA texts say | Where |
|---|---|---|
| What does the firm deliver? | A report with its opinion on whether the description presents the system as designed and implemented, whether the controls were suitably designed, and for a Type 2 whether they operated effectively. The firm signs it, adds its city and state, and dates it. | Guide 1.04, 4.01; AT-C 205 .63k to .63n |
| Who performs the examination? | In the US, CPAs: the Guide is written to help CPAs report on these controls, the attestation standards call the CPA a “practitioner,” and AICPA members must follow those standards under the Code of Professional Conduct. Outside the US, a CPA or equivalent such as a Chartered Accountant may perform a SOC 2 examination under ISAE 3000 (Revised) where local rules allow. A US firm must report under the AICPA standards and may cite ISAE 3000 as well. | Guide front matter, footnote 3 to 1.04, Appendix G inquiries 1 to 3 (nonauthoritative); AT-C “Authority of the SSAEs” |
| Must the firm be independent of the company? | Yes, in fact and in appearance. The Guide warns that helping a client design or integrate its GRC tool can threaten that independence. | Guide 1.95, 2.41, 2.45; AT-C 205 .63i |
| Is a licence or peer review a condition? | Not in these texts, which govern how the work is done, though AT-C counts state board rules among the ethical requirements. In the US, state accountancy laws, which follow the Uniform Accountancy Act’s model, generally restrict SSAE examinations such as SOC 2 to licensed CPA firms, and state boards generally require those firms to undergo peer review. A Pass with Deficiencies or Fail rating leads to remediation, not automatic loss of the licence, so the rating is yours to read. | State accountancy law (Uniform Accountancy Act §3 “attest” and its comment, §7(h)); AT-C 205 .A94 |
| Who may use the report? | The specified parties it names. The company distributes it, and the firm cannot control distribution after release. | Guide 1.09, 4.36, 4.97; AT-C 205 .65, .A110 |
Peer review is the AICPA program that examines a firm’s quality management system every three years, and the AICPA says virtually every firm doing accounting or audit work must take part. AT-C 105 .09 treats it as a firm-level matter: quality control standards govern a firm’s practice as a whole, and a deficiency in them does not by itself show that a given engagement fell short. A peer review result therefore tells you about the firm’s system, not whether one report is sound. The AICPA’s peer review summary lists SOC 1 and SOC 2 examinations among the engagements a reviewer must select, when the firm performs them. On each US firm’s profile we show its peer review standing, with a link to the AICPA record where we have matched one. Pass with Deficiencies is not Pass, and a missing public rating is not a Fail.
Timing matters for what a company can say. A report carries the firm’s signature and a date no earlier than the date the firm obtained sufficient evidence for its opinion (AT-C 205 .63l to .63n). Until a company holds that signed report, “preparing for SOC 2” or “examination in progress” is what it can accurately say. The next section covers how to check the report once you have it.
How Can a Buyer Verify a SOC 2 Claim?
Ask for the report, read its opinion, period, and scope, then check the issuing firm’s CPA licence and peer review status. In a 2026 notice about allegations against a compliance vendor, the AICPA said it would act if the auditors involved had not followed professional standards, were not enrolled in peer review, or were unlicensed. Those are the same checks to run on any report you receive.
- Ask for the report. SOC 2 reports are restricted-use documents, limited to specified parties, so expect an NDA. Read the opinion, the period, the scope, and the exceptions. Our SOC 2 audit report guide gives a reading order.
- Confirm the CPA licence. Look up the firm and signing CPA with the state board of accountancy or on NASBA CPAverify. A compliance platform is not a CPA firm and cannot issue the report: the Journal of Accountancy notes that most SOC tool vendors are not CPA firms and cannot attest to controls. The CPA licensing guide covers out-of-state firms. For a non-US firm, ask for its local licence or registration and the body that oversees its work.
- Check peer review. Search the AICPA Peer Review Public File. A missing public result does not prove a problem, since not every review is public; ask the firm for its accepted review report. The peer review guide explains the ratings.
- Check how current it is. Compare the period end date with your own review date, and ask for a bridge letter if there is a gap. Management writes that letter, and it does not extend the CPA firm’s opinion.
These checks show a report is plausibly genuine and recent. They do not show the testing was rigorous or that the scope covers your risk; how to check a SOC 2 report is real goes further.
Tell us your scope once and we return 3–10 ballpark quotes from matched firms, free and anonymized: get SOC 2 audit quotes. Or browse the SOC 2 auditor directory to compare firms yourself.
More in SOC 2 Basics