We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

SOC 2: what is it, and who asks for it?

A customer wants your SOC 2 report, so start by checking what they need it to show.

SOC 2 is an examination of a service provider’s system and controls, the measures used to protect or manage a service. Customers and business partners ask for the report to help assess the provider. Check which type they need and what it must cover.

Checked 8 October 2026

Contents
  1. What does SOC 2 mean?
  2. Who asks for a SOC 2 report?
  3. What is the difference between Type 1 and Type 2?
  4. Which service and controls does the report cover?
  5. How do you read a SOC 2 report?
  6. What if your business has no SOC 2 report?
  7. What to do
  8. Common questions
  9. Sources

What does SOC 2 mean?

SOC stands for system and organization controls. In a SOC 2 examination, an accountant examines the provider’s description of its system and the controls within it.

The report gives the customer evidence to read. AICPA says buyers need to analyse it to make decisions about the risks of using that supplier.

Who asks for a SOC 2 report?

Customers and business partners often ask a service provider for a SOC 2 report. If your customer asks, find out what they need the report to show.

UK National Cyber Security Centre guidance, known as the NCSC, says security requirements should match the risks and be achievable. Buyers should ask for evidence that suppliers can meet those requirements.

To support their information needs, customers and business partners often request a SOC 2 report from the service organization.

AICPA & CIMA SOC 2 guidance
Read original

What is the difference between Type 1 and Type 2?

Type 1 checks how controls are designed and whether they are in place at a particular date. Type 2 also examines whether controls worked over a period. That period is part of what the report covers.

Type 1 and Type 2 answer different questions about time
QuestionType 1Type 2
When are the controls examined?At a particular date.Over a stated period.
What is examined?How controls are designed and whether they are in place.How controls are designed and whether they worked over the period.
What should you keep in mind?It does not test whether controls worked over time.Its examination relates to the period stated in the report.

Which service and controls does the report cover?

Read the system description and the controls covered. Compare them with the service the customer is buying and the questions they need answered.

The Assurance Desk recorded Fiddler AI’s website on 20 September 2026. Fiddler said its SOC 2 Type II report covered security, confidentiality and availability. This was the firm’s own description of its report.

That example shows why the coverage matters. Read what the report actually examines when deciding whether it answers the customer’s questions.

How do you read a SOC 2 report?

Start with the customer’s requirements, then work through the report. Check the service, the date or period examined, and what the controls show. Ask about anything that leaves a customer requirement unanswered.

Read the report against the customer’s request

  1. Match the service Read which system and controls are covered.
  2. Check the dates Note the date or period examined.
  3. Read the findings Look at what the examination says about the controls.
  4. Ask about gaps Clarify anything that does not answer the customer’s request.
These checks help you ask useful questions. The customer still needs to confirm whether the evidence meets their requirements.

What if your business has no SOC 2 report?

If your business has no SOC 2 report, tell the customer what evidence you have. Ask what they require. The NCSC says suppliers should seek clear guidance and check whether customers are happy with the proposed security measures.

A customer’s agreement matters. Suppliers must meet the requirements that apply to them, and security requirements should be included in the contract.

What to do

  1. Ask which report the customer needs and what it must show.
  2. Check the service, controls and date or period covered.
  3. Read the findings and ask the customer about any unanswered requirements.
  4. Record the agreed security requirements in the contract.

Common questions

Does Type 1 show that controls worked over time?

No. Type 1 checks the design and implementation of controls at a particular date. It does not test their operation over a period.

Does a SOC 2 report replace a security questionnaire?

Ask the customer which evidence they need. Read the report against their questions and confirm whether it meets their requirements.

Do we need SOC 2 and ISO 27001?

Start with the customer’s requirements. Ask which documents they need before committing to both.

Where next

Sources

  1. aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA, checked 8 October 2026
  2. schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman, checked 8 October 2026
  3. NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, checked 8 October 2026
  4. aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA, checked 8 October 2026
  5. aicpa-cima.com, AICPA System and Organization Controls communications guidelines, Resources, AICPA & CIMA, checked 8 October 2026
  6. The Assurance Desk, Fiddler AI profile, checked 8 October 2026

This is an independent editorial guide, not legal advice.