Compliance
SOC 2: What It Means for Your Organization
SOC 2 is the report a customer asks for when they want an independent look at how you protect their data.
A licensed CPA firm examines your controls and writes the opinion. ALCON DTS helps you run the controls and keep the evidence ready. We do not issue the report.
Jump to an answer
At a glance
- SOC 2 is an attestation from a CPA firm, not a certificate.
- The criteria come from the American Institute of Certified Public Accountants. Security is always included. Availability, confidentiality, processing integrity, and privacy are added only if the report names them.
- Type I looks at design on one date. Type II looks at whether the controls operated over a period, often six to twelve months.
- A customer request is what starts this work. The standard does not apply to every firm.
- The report is shared under the terms the CPA firm and the customer set. It is not a public badge.
- ALCON DTS does not issue a SOC 2 report.
What it is
What is SOC 2?
SOC 2 stands for System and Organization Controls 2. It is a way for a service organization to describe its system and have a CPA firm examine the controls against the Trust Services Criteria.
The firm chooses the categories. Security is the common criteria and is always part of the examination. The other four are optional. A report that says Security only is a real SOC 2 report. A report that adds Availability or Confidentiality is a different scope, and the evidence has to match.
What it covers
What it covers, and what it does not
It covers the system you describe: the services, the people, the software, the procedures, and the data the customer is asking about. The CPA firm tests the controls you claim for that system.
It does not replace a contract. It does not replace HIPAA, PCI DSS, or a state privacy law. It does not make a policy binder into a report. The opinion belongs to the CPA firm.
Who it covers
Does it apply to you?
It applies when a customer, an insurer, or a buyer asks for it, or when you decide a report will shorten the next sale. A firm that never handles someone else’s data usually has no reason to start.
A quick check:
- A contract or a questionnaire asks for SOC 2.
- You provide a service that holds or can affect customer data.
- You can name the system the report will describe.
If those are true, the next choice is Type I or Type II, and which categories the customer actually named. Do not add Privacy or Processing Integrity because they sound complete.
Requirements
What you need in place
A report needs a system description, a control set mapped to the categories you chose, and evidence that those controls exist. Type II also needs evidence across the examination period.
- Owners for each control.
- Policies that match what the systems do.
- Access reviews, change records, and vendor reviews you can show.
- Logging, backup tests, and incident notes for the period the report covers.
- A CPA firm engaged before the period starts, if the goal is Type II.
How we help
How ALCON DTS helps
You keep the CPA firm and the system description. We run the controls on the systems we support and keep the evidence with you.
| SOC 2 element | What ALCON DTS provides |
|---|---|
| System picture | The identity, devices, email, network, and backups that belong in the description |
| Access | Unique accounts, multifactor authentication, and admin rights limited to the people who need them |
| Change and vendors | Records of material changes and the providers that can affect the system |
| Logging and restore | Logging on the managed environment, and backup and restore practice you can show |
| Evidence file | The settings, reviews, and test notes the CPA firm asks to sample |
| Readiness | A gap list before the examination period, so the period does not start on a control you cannot show |
The exact controls depend on the plan and any project work. The review shows what is in place and what would close a gap before a Type I date or a Type II period.
Need a clear picture of a SOC 2 ask? A review looks at who asked for the report, which categories they named, and what the systems can already show.
Related rules
How it fits other rules
A security questionnaire often asks for the report or for the same controls. See our Security Questionnaires guide.
ISO 27001 is a certificate from a registrar. SOC 2 is a report from a CPA firm. A customer may ask for one, the other, or both.
PCI DSS still governs payment cards. HIPAA still governs patient information. Those duties do not fold into the SOC 2 opinion. See PCI DSS for Merchants and HIPAA Security Risk Analysis.
Questions
Frequently asked questions
Is SOC 2 a certification?
No. A CPA firm issues an examination report. People say certified. The document a customer wants is the report.
Who writes the opinion?
A licensed CPA firm. ALCON DTS prepares the controls and the evidence. We do not sign the report.
Should we start with Type I or Type II?
Type I shows design on one date and can keep a deal moving. Type II is what most buyers want, because it covers a period. The customer’s ask decides.
Does Security-only count?
Yes. Availability, confidentiality, processing integrity, and privacy are included only when the report names them.
How long is a Type II period?
Often six to twelve months. The CPA firm sets the window. Evidence has to exist across that window.
Does a Microsoft 365 setup finish SOC 2?
No. Identity, mail, devices, and logging are part of the system. The description and the CPA firm still decide the rest.
Services
Related services
- Regulatory Compliance: program support for the frameworks and reports your customers ask for
- Secure IT: tighter identity, email and device protection with compliance support in the same relationship
- Cybersecurity: security controls, monitoring and response inside managed IT
- Managed Microsoft 365: identity, email, sharing, retention and audit managed as part of IT
Sources
Sources
- AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy
- Your CPA firm’s engagement letter for the report type and the categories
Next step
Talk with ALCON DTS
A review of your needs and growth plans looks at who asked for the report, which categories they named, and what the systems can already show. You keep the CPA firm. We run the controls and keep the evidence file with you.
