
## SOC 2

Service Organization Control 2

SOC 2 defines criteria for managing customer data based on five "trust service principles": security, availability, processing integrity, confidentiality, and privacy.

!https://www.imperva.com/learn/wp-content/uploads/sites/13/2019/01/soc-2.png

SOC 2 does not have strict requirements, which means that SOC 2 reports are unique for each organization. Consequently, there is some room for negotiation with the auditor about what is necessary to meet a specific requirement.

**SOC 2 Exceptions** - an exception is some instance of non-conformance to the SOC 2 requirements. exception doesn’t necessarily means audit “failure”.

### Why should I be SOC 2 compliant?

**meet customers demands** - many customers would demand SOC 2 compliance before doing any business with you or even starting a sales conversation.

**prevent security risks** - SOC 2 ensures that there are no gaps in your organization’s security posture and improves risk management

### Types of SOC 2

**SOC 2 type 1** - evaluates an organization’s cybersecurity controls at a single point in time.

**SOC 2 type 2** - how well a service organization's system and controls perform over a period of time (typically 3-12 months)

### Audit failure

you can’t really “fail” an audit. instead the auditor give you an opinion of how closely they believe your company is meeting SOC 2 standards.

**qualified opinion** - the company meets the SOC 2 standards, but might have few exceptions.

**adverse opinion** - organization doesn’t meets SOC 2 standards.

**disclaimer** - the auditor can’t complete the audit, usually due to missing information

audit is a yearly process, losing SOC 2 compliance can result in losing customers that care about security controls.

What class is most relevant to this document?
1. Financial Report
2. Product Requirements
3. Documentation
4. Other - please explain Provide your response in exactly 7 paragraphs (separated nearby paragraphs with 3 aterisk symbols ***).
user