SOC 2 (System and Organization Controls 2) is an audit framework developed by the AICPA for technology and SaaS service providers. While voluntary, it is a standard contractual requirement in the US enterprise market and increasingly in Europe.
Trust Service Criteria (TSC)
- Security (required): controls against unauthorized access
- Availability: system available for operation and use
- Processing Integrity: processing is complete, valid and timely
- Confidentiality: information designated as confidential is protected
- Privacy: personal information collected, used and retained per commitments
Report types
- Type I: design of controls at a point in time
- Type II: operating effectiveness over a period (typically 6–12 months)
ermine and SOC 2
ermine maps SOC 2 controls against your infrastructure, manages continuous evidence collection for the audit period and generates reporting for external auditors.