SOC 2 Report

What is a SOC 2 report?

A SOC 2 report is the document a CPA firm writes after a SOC 2 examination of a vendor. It often runs to dozens of pages, but you do not need to read every page.

Reports usually have these parts, in this order (AICPA):

1. Auditor's report: the opinion, plus the scope and period.
2. Management's assertion: the vendor's own written statement that its description and controls are accurate.
3. System description: the services, systems, people and processes covered, plus the controls customers and subservice organizations are expected to run.
4. Controls and tests: each control, how the auditor tested it, and the result. In a Type 2 report this is usually the longest part.
5. Other information: optional extras, such as management's replies to exceptions.

What it looks like in a vendor's terms

A typical clause reads like this:

You may use our SOC 2 report only to assess our services. You must keep it confidential, may not share it outside your company, and must destroy copies if we ask.

• Only to assess our services: you can use it for vendor review, not marketing.
• Keep it confidential: the report is restricted use, so expect an NDA.
• Destroy copies: you may need to request it again next year.

Atlassian's SOC 2 page puts most reports behind a click-through NDA. One NDA it shows limits use to one year or the term stated in the report, whichever is shorter.

How to read it in 20 minutes

1. Check the type and the period. Type 2 covers a period; note when it ended.
2. Read the opinion first. An unmodified opinion is the clean result.
3. Check the scope: product, legal entity and trust services categories. See SOC 2 scope.
4. Skim the controls and tests section for the word "exception."
5. List the CUECs, the controls you must run.
6. Note the subservice organizations and whether they are carved out. See carve-out method.
7. If the period ended months ago, ask for a bridge letter.

Keep short notes as you go: the period, the opinion, any exceptions and the CUECs. Those notes are what you will need next year, and what your own auditor or customer may ask to see.

The management assertion is worth a glance too. It is the vendor stating, in writing, that its description is fair and its controls met the criteria. If the description does not match the product you bought, that is the first question to raise.

SOC 2 Exceptions

An exception, also called a deviation, is a test result showing a control did not work as described. It appears next to that control in the tests section.

For example, an auditor checks 25 people who left the company and finds two still had access a week later. That would be noted as an exception to the access removal control.

An exception is not an automatic failure. The auditor weighs exceptions one by one and together, and can still give a clean opinion (AICPA). If problems are material, the auditor can issue a qualified opinion, which names the parts affected. The opinion can also be adverse or disclaimed, which are far worse.

When you find an exception, ask three questions:

• Does it touch data or access that matters to you?
• What did management say, and has it been fixed since?
• Did the same exception appear last year?

Management's reply is the vendor's own statement, so ask for evidence of the fix.

Why it matters to you

The report is the closest you get to an outside view of a vendor's security. If you skip scope and exceptions, you may tell your own customers a vendor is covered when it is not.

The report also tells you what is on you. If it assumes you remove leavers' access and you do not, a breach through that gap is yours to explain, not the vendor's.

What to check

• The report is Type 2 and its period ended within the last year.
• The opinion is unmodified.
• Every exception has a reply and a date it was fixed.
• You actually run the CUECs it lists.
• Carved-out providers match the vendor's subprocessor list.

How Venpo helps

Venpo monitors the public pages around the report: trust center pages, security addenda, DPAs and subprocessor lists. You get a plain-English email when one changes, so you know when a review is due again.