SOC 2 has become the de facto trust standard for technology service providers. But the term gets thrown around loosely, and many buyers don't understand what they're actually evaluating. A SOC 2 Type 2 report isn't just a better version of Type 1—it's a fundamentally different assertion about how a company operates.
The Five Trust Service Criteria
SOC 2 is built around five trust service criteria, defined by the AICPA. Most companies include Security (which is required) and select additional criteria based on their services and client expectations.
Highlighted: Criteria included in Primus's SOC 2 report
We chose Security, Availability, and Confidentiality because they align with what our clients care about most. Security is table stakes. Availability matters because our automation solutions need to run reliably. Confidentiality matters because we handle sensitive client data during process discovery and implementation.
Type 1 vs. Type 2: The Critical Difference
This is where confusion runs rampant. A Type 1 report evaluates whether controls are designed appropriately at a specific point in time. A Type 2 report evaluates whether those controls operated effectively over a period of time—typically 6 to 12 months.
| Aspect | SOC 2 Type 1 | SOC 2 Type 2 |
|---|---|---|
| What it tests | Control design at a point in time | Control effectiveness over time |
| Audit period | Single date (snapshot) | 6-12 month period |
| Evidence required | Documentation and design review | Operating evidence and testing |
| What it proves | "We have controls" | "Our controls actually work" |
| Common use | First-time certification, interim step | Ongoing assurance, client requirement |
Why Type 2 Matters
Anyone can write a policy. Type 1 confirms policies exist. Type 2 confirms you actually follow them. When a client asks for SOC 2, what they really want to know is whether your security practices are real or theoretical. Only Type 2 answers that question.
What the Audit Actually Examines
A SOC 2 Type 2 audit isn't a casual review. Auditors examine evidence that controls operated consistently throughout the audit period. This means logs, records, tickets, and documentation—not just policies.
Figure 1: Type 2 audits examine evidence across the entire audit period, not just documentation.
Sample Testing
Auditors don't review every transaction—they use sampling. For a 12-month audit period, they might sample 25-40 instances of each control. If you process 10,000 access requests during the period, they'll examine a representative sample to determine whether your access control process works consistently.
This is why operational discipline matters. One failed control instance might be understandable. A pattern of failures indicates the control doesn't actually work. The report will note exceptions, and sophisticated clients will ask about them.
Reading a SOC 2 Report
Most people never actually read SOC 2 reports—they just confirm one exists. But the report contains valuable information for anyone evaluating a vendor's security posture.
The most important section isn't the opinion letter—it's the description of the system and the control activities. That's where you learn what they actually do, not just that an auditor blessed it.
Key Sections to Review
Section I: Auditor's Opinion — Did controls operate effectively? Look for "qualified" vs. "unqualified" opinions. Unqualified is clean; qualified means there were issues.
Section III: System Description — This describes what's actually in scope. A company might have SOC 2, but only for specific services. Make sure what you're buying is covered.
Section IV: Control Activities — The detailed list of controls and how they were tested. This is where you see what they actually do for security.
Section V: Exceptions — Any control failures identified during testing. Read these carefully. Some exceptions are minor; others are red flags.
The Continuous Compliance Challenge
Here's what SOC 2 taught us: compliance isn't an event—it's a state of being. You can't cram for a Type 2 audit. If your controls weren't operating effectively during the audit period, no amount of last-minute preparation will change the evidence.
This forced us to build compliance into daily operations rather than treating it as an annual exercise. Access reviews happen on schedule because the audit will check. Changes go through approval workflows because auditors will sample them. Incidents get documented properly because the record matters.
The Compliance Mindset Shift
Before SOC 2, compliance felt like something we did for auditors. After Type 2, we realized compliance is something we do for ourselves. The controls exist because they make us more secure, not because someone will check. The audit just confirms we're doing what we should be doing anyway.
Common Misconceptions
"SOC 2 certified" — There's no such thing. SOC 2 produces a report, not a certification. Companies that claim to be "SOC 2 certified" are either confused or misleading you.
"We passed SOC 2" — SOC 2 isn't pass/fail. The auditor issues an opinion on whether controls operated effectively. An unqualified opinion is clean, but even reports with exceptions aren't "failures."
"SOC 2 means we're secure" — SOC 2 means controls were tested and found effective. It doesn't guarantee security—no framework does. It provides reasonable assurance, not absolute certainty.
What SOC 2 Doesn't Cover
SOC 2 is powerful but not comprehensive. It doesn't test the technical security of your systems—no penetration testing, no vulnerability assessment. It tests whether your security processes work, not whether your technology is secure.
That's why sophisticated security programs combine SOC 2 with other assessments. We complement our SOC 2 report with regular penetration testing, vulnerability scanning, and security awareness training. The report demonstrates process discipline; other assessments validate technical security.
Understanding SOC 2 Reports
- Type 2 > Type 1: Type 2 tests whether controls actually work over time, not just whether they exist
- Read the scope: Verify the services you're using are covered by the report
- Check for exceptions: Understand what went wrong and whether it's been remediated
- It's not certification: SOC 2 produces a report with an auditor opinion, not a pass/fail certificate
- Annual renewal: Reports are valid for one year; ask for the most recent report
- Complement with technical testing: SOC 2 tests processes, not technical vulnerabilities
Why We Maintain SOC 2 Type 2
The annual audit is work. Evidence collection takes weeks. The audit itself consumes management attention. And the report costs money. But we maintain it because our clients need the assurance, and honestly, because it makes us better.
Knowing that auditors will examine our controls in detail creates accountability. It's easy to let processes slip when no one's watching. SOC 2 Type 2 means someone is always watching—even if the audit is months away, the evidence we create today will be examined later.
For companies serving regulated industries, SOC 2 Type 2 is increasingly non-negotiable. It's not the only factor in vendor selection, but its absence is often disqualifying. We'd rather invest in maintaining the report than lose opportunities because we can't demonstrate operational security.
