Request a callback

Glossary · AICPA · SOC for Service Organizations: Trust Services Criteria

SOC 2

Definition

AICPA · SOC for Service Organizations: Trust Services Criteria

An attestation report, issued by a licensed CPA firm under AICPA standards, on a service organisation's controls relevant to security and, optionally, availability, processing integrity, confidentiality and privacy. It is not a certificate: the auditor gives an opinion on your system description and controls against the Trust Services Criteria, and you share the report with customers under NDA. Indian SaaS and IT services companies selling to US buyers meet it as a procurement requirement.

Also called SOC 2 reportSOC 2 attestation
Read the source

Sources: AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022); AICPA, 2018 SOC 2 Description Criteria (with revised implementation guidance, 2022)

In other laws

LawTermNote
ISO/IEC 27001ISMS certificationA certificate from an accredited body after Stage 1 and Stage 2 audits, renewed every three years; SOC 2 is a report that covers a fixed period.
DPDP Act 2023No equivalentDPDP requires security safeguards (s. 8(5)) but prescribes no report or certificate; a SOC 2 is evidence, not compliance.

Where it appears

TSP 100

Trust Services Criteria the report is written against

DC 200

Description criteria for the system description

Related terms

Trust Services CriteriaType 1 vs Type 2 reportSystem descriptionInformation security management system (ISMS)

This page explains the law in plain English. It is not legal advice.