What it means
What a report describes
SOC 2 reporting can address security and other relevant criteria such as availability, processing integrity, confidentiality or privacy. The report’s system description, scope and auditor’s opinion determine what was examined.
Use the actual report
Review the covered service, reporting date or period, exceptions and responsibilities assigned to customers. A supplier logo or summary statement does not provide the same evidence as the report. Distinguish the report type and engagement scope before drawing conclusions about operating controls.
Related concepts
In practice
A concrete example
A payment team requests the report for the actual service, then checks exceptions and the controls the customer is expected to operate.
Technical notes & boundaries
SOC 2 is an attestation report, not an ISO-style certification or a guarantee of regulatory compliance. It is different from SOC 1 and SOC 3.
Go to the source.
Original references used for this definition. Product details and standards can change.