Guide: SOC 2 reporting on an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.

Updated as of January 1, 2018, this guide includes relevant guidance contained in applicable standards and other technical sources.

It explains the relationship between a service organisation and its user entities, provides examples of service organisations, describes the description criteria to be used to prepare the description of the service organisation's system, identifies the trust services criteria as the criteria to be used to evaluate the design and operating effectiveness of controls, explains the difference between a type 1 and type 2 SOC 2 report, and provides illustrative reports for CPAs engaged to examine and report on system and organisation controls at a service organisation.