How it works
SOC 2 is an attestation framework from the AICPA, the American Institute of Certified Public Accountants. A licensed CPA firm examines a service organization, such as a software vendor, against the Trust Services Criteria. Security is always in scope; availability, confidentiality, processing integrity and privacy are added when they matter to customers.
A Type I report looks at a single date and asks whether the controls are designed properly. A Type II report covers a period, commonly several months to a year, and the auditor tests samples of evidence across it, such as access reviews, change approvals, incident tickets and offboarding records, to confirm the controls actually operated.
The report is private and usually shared with customers under a nondisclosure agreement. It contains the auditor's opinion, the vendor's description of its system, each control with the tests performed, any exceptions found, and complementary user entity controls: the things the customer must do, such as managing its own users, for the controls to hold.
How to measure it
- Check the report type and the review period, and that the period ended recently.
- Read the auditor's opinion first; an unqualified opinion means no material problems were found.
- Review every listed exception and the vendor's response.
- Check which Trust Services Criteria are in scope, and whether sub-service providers such as hosting are covered by their own reports.
- Note the complementary user entity controls your own team must run.
Common mistakes
- Treating a Type I report as proof that controls work over time.
- Accepting a hosting provider's report or certificate as if it covered the vendor itself.
- Reading only the opinion and skipping the exceptions.
- Confusing SOC 2 with ISO 27001; they are different frameworks with different auditors and outputs.
How Kadence helps
Kadence is SOC 2 compliant and holds Cyber Essentials certification. Its infrastructure partners are SOC 2 compliant and ISO 27001 certified; Kadence does not claim that certification as its own. Controls are monitored continuously through Drata, systems are penetration-tested at least annually by third-party specialists, and the Kadence trust portal holds the evidence for a security review.
Security and trust · For IT and security teams
Frequently asked questions
What is the difference between SOC 2 Type I and Type II?
A Type I report checks whether controls are designed properly at a single point in time. A Type II report tests whether those controls actually operated over a period, using samples of real evidence. Buyers usually ask for Type II because it shows how the vendor behaves day to day, not just on the audit date.
Is SOC 2 a certification?
Not strictly. It is an attestation: an independent CPA firm examines the controls and issues a report with its opinion. Vendors often say they are certified or compliant, but what a buyer should ask for is the report itself, its type and its review period.
How long is a SOC 2 report valid?
The report has no formal expiry, but it only describes the period it covers. Most buyers expect a new Type II report every year and ask the vendor for a bridge letter covering the gap between the end of the last review period and today.
What is the difference between SOC 2 and ISO 27001?
The SOC report is an attestation under AICPA standards, common in North America, that tests specific controls over a period. The ISO information security standard is an international certification of a whole information security management system, issued by an accredited certification body. They answer related but different questions, and many vendors hold one or both.
Why do buyers ask software vendors for a SOC report?
Because the vendor will hold or process the buyer's data. An independent report saves the buyer from auditing the vendor itself and gives security, IT and procurement teams tested evidence about access control, change management, incident response and monitoring before they sign.
Related terms
- Single sign-on (SSO) One set of company credentials to sign in to many apps, verified by the identity provider rather than each app.
- SCIM provisioning An open standard that creates, updates and deactivates user accounts in apps automatically from the company directory.
- Employee monitoring vs occupancy data Employee monitoring tracks what individuals do; occupancy data measures how spaces are used. Workplace planning needs only the second.
Sources
- System and Organization Controls: SOC Suite of Services, AICPA & CIMA
- 2017 Trust Services Criteria (With Revised Points of Focus – 2022), AICPA & CIMA
Kadence editorial team · Last reviewed