What is SOC 2?
SOC 2 is a report on controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy. The AICPA sets the professional standards, and an independent CPA firm carries out the examination. The result is an attestation report by that firm. It is not a certificate and not a regulation.
The criteria are the AICPA 2017 Trust Services Criteria with revised points of focus from 2022. The organization chooses which of the five categories are in scope, so reports differ. The AICPA has also published exposure drafts of proposed revised criteria titled Proposed 2027. They are proposals and not final.
A Type 1 report covers whether controls are suitably designed at a point in time. A Type 2 report also covers whether the controls operated effectively over a stated period. SOC 2 reports are intended for the organization's customers and other specified users, while the AICPA describes SOC 3 reports as general-use reports.
Where an organization relies on subservice organizations, the report may include them or carve them out. A reader should check which parts of the service are actually covered.
How it touches on-site IT work
- A report covers the provider's own controls, not a specific customer site. It says little by itself about how an engineer will behave in your server room, so the site rules still need to be written down.
- Customers that hold their own SOC 2 report are examined on how they control physical access, vendors, change and incident response. They may ask field providers to follow matching controls on site.
- Access and records: sign-in and sign-out records, escorts, change tickets and work notes become the evidence a customer's auditor asks to see.
- Media and disposal: removed drives and retired equipment need custody records and evidence of wiping or destruction.
- Subcontractors: if independent engineers or partner firms do part of the work, a customer will ask how they are screened, bound and monitored.
- Not every field services provider has its own SOC 2 report. One without a report can still answer a security questionnaire and agree controls in the scope. One that says it has a report should show it, with its period and scope.
What you can agree in a written scope
- Named engineers or an approved pool, with confidentiality commitments for each.
- Physical access rules and records: ID checks, escorts, time windows and sign-in logs.
- Change and work records: ticket references, work notes and photos tied to the customer's change process.
- Custody records and wipe or destruction evidence for removed media and retired equipment.
- A rule on subcontractors: approval first, and the same controls passed down.
- Incident notification: who is told, how and within what time, including lost equipment or suspected tampering.
- A periodic security questionnaire or review, with the provider's answers kept current.
- Retention and deletion of records, photos and tickets at the end of the engagement.
Questions to ask any field services provider
- Do you have a SOC 2 report? If so, is it Type 1 or Type 2, and what period does it cover?
- Which Trust Services categories, services and locations are in its scope?
- Who issued it, and did the opinion note any exceptions?
- Are any subservice organizations carved out, and does that include the people who would attend our site?
- If you do not have a report, how do you evidence access control, change records, vendor oversight and incident response?
- Will you complete our security questionnaire and agree these controls in the scope?
This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.
Official sources
- AICPA and CIMA: System and Organization Controls (SOC) suite of services (opens in a new tab)
- AICPA and CIMA: SOC 2 reporting guide (opens in a new tab)
- AICPA and CIMA: 2017 Trust Services Criteria (with revised points of focus 2022) (opens in a new tab)
- AICPA and CIMA: Exposure drafts of proposed 2027 SOC 2 criteria (opens in a new tab)