# SOC 2: what is it, and who asks for it?

A customer wants your SOC 2 report, so start by checking what they need it to show.

The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026.

**The short answer.** SOC 2 is an examination of a service provider’s system and controls, the measures used to protect or manage a service. Customers and business partners ask for the report to help assess the provider. Check which type they need and what it must cover ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## What does SOC 2 mean?

SOC stands for system and organization controls. In a SOC 2 examination, an accountant examines the provider’s description of its system and the controls within it ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [aicpa-cima.com, AICPA System and Organization Controls communications guidelines, Resources, AICPA & CIMA](https://www.aicpa-cima.com/resources/article/aicpa-system-and-organization-controls-communications-guidelines), checked 8 October 2026).

The report gives the customer evidence to read. AICPA says buyers need to analyse it to make decisions about the risks of using that supplier ([aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA](https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management), checked 8 October 2026).

## Who asks for a SOC 2 report?

Customers and business partners often ask a service provider for a SOC 2 report. If your customer asks, find out what they need the report to show ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

UK National Cyber Security Centre guidance, known as the NCSC, says security requirements should match the risks and be achievable. Buyers should ask for evidence that suppliers can meet those requirements ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

> "To support their information needs, customers and business partners often request a SOC 2 report from the service organization."
> AICPA & CIMA, SOC 2 guidance
> aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA, https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy (checked 8 October 2026)

## What is the difference between Type 1 and Type 2?

Type 1 checks how controls are designed and whether they are in place at a particular date. Type 2 also examines whether controls worked over a period. That period is part of what the report covers ([schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman](https://www.schellman.com/blog/soc-examinations/soc-report-type-1-vs-type-2), checked 8 October 2026).

**Type 1 and Type 2 answer different questions about time**

| Question | Type 1 | Type 2 |
| --- | --- | --- |
| When are the controls examined? | At a particular date. | Over a stated period. |
| What is examined? | How controls are designed and whether they are in place. | How controls are designed and whether they worked over the period. |
| What should you keep in mind? | It does not test whether controls worked over time. | Its examination relates to the period stated in the report. |

Source: schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman, https://www.schellman.com/blog/soc-examinations/soc-report-type-1-vs-type-2 (checked 8 October 2026)

## Which service and controls does the report cover?

Read the system description and the controls covered. Compare them with the service the customer is buying and the questions they need answered ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA](https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management), checked 8 October 2026).

The Assurance Desk recorded Fiddler AI’s website on 20 September 2026. Fiddler said its SOC 2 Type II report covered security, confidentiality and availability. This was the firm’s own description of its report ([The Assurance Desk, Fiddler AI profile](https://theassurancedesk.com/advisers/fiddler-ai), checked 8 October 2026).

That example shows why the coverage matters. Read what the report actually examines when deciding whether it answers the customer’s questions ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), [aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA](https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management) and [The Assurance Desk, Fiddler AI profile](https://theassurancedesk.com/advisers/fiddler-ai), checked 8 October 2026).

## How do you read a SOC 2 report?

Start with the customer’s requirements, then work through the report. Check the service, the date or period examined, and what the controls show. Ask about anything that leaves a customer requirement unanswered ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), [aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA](https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management) and [schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman](https://www.schellman.com/blog/soc-examinations/soc-report-type-1-vs-type-2), checked 8 October 2026).

**Read the report against the customer’s request**

1. Match the service: Read which system and controls are covered.
2. Check the dates: Note the date or period examined.
3. Read the findings: Look at what the examination says about the controls.
4. Ask about gaps: Clarify anything that does not answer the customer’s request.

These checks help you ask useful questions. The customer still needs to confirm whether the evidence meets their requirements.

Source: aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA, https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy (checked 8 October 2026); NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026); aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA, https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management (checked 8 October 2026); schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman, https://www.schellman.com/blog/soc-examinations/soc-report-type-1-vs-type-2 (checked 8 October 2026)

## What if your business has no SOC 2 report?

If your business has no SOC 2 report, tell the customer what evidence you have. Ask what they require. The NCSC says suppliers should seek clear guidance and check whether customers are happy with the proposed security measures ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

A customer’s agreement matters. Suppliers must meet the requirements that apply to them, and security requirements should be included in the contract ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## What to do

1. Ask which report the customer needs and what it must show ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).
2. Check the service, controls and date or period covered ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman](https://www.schellman.com/blog/soc-examinations/soc-report-type-1-vs-type-2), checked 8 October 2026).
3. Read the findings and ask the customer about any unanswered requirements ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA](https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management), checked 8 October 2026).
4. Record the agreed security requirements in the contract ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## Common questions

### Does Type 1 show that controls worked over time?

No. Type 1 checks the design and implementation of controls at a particular date. It does not test their operation over a period ([schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman](https://www.schellman.com/blog/soc-examinations/soc-report-type-1-vs-type-2), checked 8 October 2026).

### Does a SOC 2 report replace a security questionnaire?

Ask the customer which evidence they need. Read the report against their questions and confirm whether it meets their requirements ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA](https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management), checked 8 October 2026).

### Do we need SOC 2 and ISO 27001?

Start with the customer’s requirements. Ask which documents they need before committing to both ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## Where next

- [ISO 27001 or SOC 2: which does your customer want?](https://theassurancedesk.com/guides/iso-27001-or-soc-2.md)
- [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md)
- [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md)
- [How do you answer a security questionnaire without a certificate?](https://theassurancedesk.com/guides/security-questionnaire-without-certification.md)

## Sources

- aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA: https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy (checked 8 October 2026)
- NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control: https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026)
- aicpa-cima.com, AICPA System and Organization Controls communications guidelines, Resources, AICPA & CIMA: https://www.aicpa-cima.com/resources/article/aicpa-system-and-organization-controls-communications-guidelines (checked 8 October 2026)
- aicpa-cima.com, Key Elements of a SOC 2 Report, Resources for Management, Resources, AICPA & CIMA: https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management (checked 8 October 2026)
- schellman.com, Understanding SOC Reports: Type 1 vs Type 2, Schellman: https://www.schellman.com/blog/soc-examinations/soc-report-type-1-vs-type-2 (checked 8 October 2026)
- The Assurance Desk, Fiddler AI profile: https://theassurancedesk.com/advisers/fiddler-ai (checked 8 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.