SOC2 Type II
System and Organization Controls
Geek Speak:
SOC 2 Type II is an independent, third-party attestation report that evaluates the design and operating effectiveness of an organization’s controls over a defined period of time, typically 6–12 months. The assessment is performed in accordance with the AICPA’s Trust Services Criteria and focuses on one or more of the following principles: Security, Availability, Processing Integrity, Confidentiality, and Privacy. A Type II report provides assurance not only that controls are properly designed, but that they are consistently implemented and functioning effectively over time.
Plain English:
SOC 2 Type II is an independent audit that confirms an organization has strong safeguards in place to protect customer data and that those safeguards have been consistently followed over time. It provides assurance that the company not only has appropriate policies and processes, but that they are actively used and monitored in day-to-day operations.