SOC 2 compliance guide
Key Takeaways
- Which criteria can a SOC 2 examination cover?
- What does a Type 1 report evaluate?
- Can puna.one issue a SOC 2 report?
Which criteria can a SOC 2 examination cover?
The AICPA's 2017 Trust Services Criteria, with revised points of focus in 2022, are criteria for security, availability, processing integrity, confidentiality, and privacy. The AICPA page dated September 30, 2023 describes them as criteria for attestation or consulting engagements on controls over information and systems used to provide products or services (AICPA, 2017 Trust Services Criteria).
Security is the common set. The other four are added only when the examination includes them. This page does not turn that list into a control-by-control checklist.
What does a Type 1 report evaluate?
In an AICPA discussion of SOC examinations, a Type 1 evaluates controls as of a specific date. Neha Patel, a CPA quoted there, said the service auditor is evaluating controls as of that date, and that evidence from after the date raises the question of what else the auditor did to show the control was in place then (AICPA & CIMA, Maintaining high standards for SOC engagements).
That article does not set a required length for a Type 2 examination. Ask the CPA firm what period a Type 2 report would cover before you treat it as the one a customer asked for.
Can puna.one issue a SOC 2 report?
No. A SOC 2 examination is an independent CPA examination. puna.one does not hold a SOC 2 report and does not issue one. Current hosting scope, separate from that examination, is on the managed hosting page.
References
- AICPA & CIMA. 2017 Trust Services Criteria (With Revised Points of Focus, 2022). Page dated September 30, 2023. https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
- AICPA & CIMA. Maintaining high standards for SOC engagements. https://www.aicpa-cima.com/professional-insights/article/maintaining-high-standards-for-soc-engagements
- Related page: managed hosting.
Guide only. puna.one does not hold, and this page does not imply, any certification, attestation or audit report for this framework.