Service Organization Control 2 (SOC 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA) for evaluating service organizations' security, availability, processing integrity, confidentiality, and privacy controls. Based on the Trust Services Criteria, SOC 2 reports provide assurance to customers about a service provider's internal controls. It is primarily used by technology and cloud service providers globally to demonstrate security practices to customers and stakeholders.
Mandatory?
Voluntary — required by enterprise procurement
Who validates?
Licensed CPA firm (SSAE 18). No self-assessment.
Renewal
Typically annual
Observation period
Type II: 3–12 months
Controls by category
70 controls are Mapped to SOC 2.
C1.1 The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality
CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
CC6.2 Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity
CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities
CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events
CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
CC8.1 The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives
PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements
PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
A SOC 2 report is based on the AICPA SSAE 18 standard. It evaluates the service organization's controls relevant to the Trust Services Criteria of security, availability, processing integrity, confidentiality, or privacy.
How does a SOC 2 Type II report differ from a Type I report?
A SOC 2 Type I report covers the design of the service organization's controls at a specific point in time. A SOC 2 Type II report covers the design and operating effectiveness of those controls over a period of time.
How often are the core Google Cloud SOC 2 Type II reports issued?
The core Google Cloud and Google Workspace SOC 2 Type II reports are issued quarterly. Customers can download them via Compliance Reports Manager. Google Cloud only issues SOC 2 Type II reports.
What are bridge letters in the SOC 2 context?
Bridge letters are attestations made by the management of the service provider. They bridge the gap from the end date of the SOC report to the customer's period end date. Google Cloud creates them monthly.
