Reading a SOC 2 report: What it contains and what you should look for

What is a SOC 2 report?

A SOC 2 report is not a certificate or a seal of approval, but a confidential attestation report from an independent accounting firm (CPA firm). Based on the AICPA Trust Services Criteria, it shows how a service provider protects its customers' data. We explain the basics, process and costs of a SOC 2 audit in “SOC 2 explained”.

The full SOC 2 report is confidential and is usually only shared under a non-disclosure agreement (NDA). The SOC 3 report, by contrast, is a shortened version that can be published freely, for example on a company's website.

When you evaluate a report, start with the auditor's opinion, then check the scope, and finally the exceptions. Many reports are filed away without being read – yet that is exactly where the limitations that qualify the evidence can be found.

How is a SOC 2 report structured?

A SOC 2 report follows a fixed structure based on the requirements of the American Institute of Certified Public Accountants (AICPA) and is usually divided into four to five sections; Section V is optional. European assurance reports under ISAE 3000 follow a similar structure.

Important for your assessment: Sections II, III and V are written by the audited company. Sections II and V are not tested by the auditor in their own right. The system description in Section III, however, is covered by the auditor's opinion: the auditor confirms that it presents the system fairly. Reliable conclusions can therefore be drawn from Sections I, III and IV.

What does the auditor's opinion mean?

The auditor's opinion in Section I summarises the overall result of the audit. The auditor chooses from four standard types of opinion:

1. Unqualified opinion: The best case. The auditor confirms that the controls are suitably designed (Type I and II) and operated effectively throughout the entire period (Type II only).
2. Qualified opinion: The auditor has identified deviations. Certain controls were not suitably designed or were ineffective at times, but the system as a whole meets the criteria in all material respects.
3. Adverse opinion: The controls deviate from the criteria so significantly that the control system as a whole is considered ineffective.
4. Disclaimer of opinion: The auditor was unable to form an opinion, for example because documents were missing or access was denied.

A qualified opinion is not a reason to reject a vendor straight away. Check in Section IV which control failed and whether it affects your own risk.

What should you look for when reviewing a report?

Reviewing a SOC 2 report as part of vendor risk management follows a clear structure. Use this 8-point checklist:

1. Check the audit period: Did the observation period covered by the report end more than 12 months ago? If so, the report is out of date.
2. Identify Type I or Type II: Is it merely a point-in-time assessment (Type I) or evidence of operating effectiveness over a period of usually 3 to 12 months (Type II)? We explain the differences in “SOC 2 Type I vs. Type II”.
3. Check the Trust Services Criteria: In addition to the mandatory Security category, are the criteria relevant to you, such as Availability, Confidentiality or Privacy, also covered?
4. Analyse the scope (Section III): Which locations, products, subsidiaries or cloud applications were excluded from the scope? Does the report cover exactly the product you use?
5. Assess the opinion (Section I): Is the opinion unqualified, or are there qualifications?
6. Evaluate the exceptions (Section IV): How many exceptions did the auditor document? In which areas did they occur, and how did management respond?
7. Consider subservice organizations (carve-out or inclusive method): If the vendor includes its own subcontractors (e.g. AWS, Azure) using the carve-out method, their controls are not part of the report and must be reviewed separately. With the inclusive method, they are covered by the audit. In a carve-out, also check the complementary controls the report expects from the subservice organization (Complementary Subservice Organization Controls, CSOCs).
8. Identify your own obligations (CUECs): Every SOC 2 report lists complementary controls that you as the customer have to implement yourself (Complementary User Entity Controls, CUECs), such as proper access management, MFA for your users or promptly removing access for employees who leave. The vendor's controls only work if you do your part.

Excluding critical IT infrastructure through the carve-out method is the most common blind spot when reviewing vendors. If a cloud provider's report uses a carve-out, you should also request the SOC 2 report of its hosting provider.

How long is a SOC 2 report valid?

Formally, a SOC 2 report has no expiry date, as it attests to a past period. In practice, however, business partners and B2B buyers usually only accept reports whose audit period ended no more than 12 months ago.

To bridge the gap between the end of the last audit period and the new report, companies often issue a bridge letter (also called a gap letter). This is a self-declaration by management confirming that no material changes were made to the control system during the unaudited interim period. An auditor has not verified this statement.

What does a SOC 2 report mean for data protection?

For companies in the EU, a SOC 2 report is good evidence that a service provider has appropriate technical and organisational measures (TOMs) in place. However, it does not replace any data protection obligations:

• Data processing agreement: If the provider processes personal data on your behalf, you still need a data processing agreement under Art. 28 GDPR.
• International transfers: If the provider is based in the US or uses US subservice organizations, you must safeguard the data transfer separately, for example through the EU-US Data Privacy Framework or standard contractual clauses.
• Privacy criterion: The Privacy category of the Trust Services Criteria is not based on the GDPR. It reflects good practice but does not prove GDPR compliance.

In Europe, ISO 27001 certification is the more widespread counterpart. Many service providers have both; the same principles apply when reviewing them: look closely at the scope, how current the evidence is and any exceptions.

How can you use your own report in sales?

If your company has its own SOC 2 report, it can speed up sales processes considerably.

• Treat it as confidential: Only share the full SOC 2 report under a non-disclosure agreement (NDA) or through a protected trust center.
• Use SOC 3 for the public: Use the detailed SOC 2 report in your customers' procurement process and the SOC 3 report for publishing on your website.
• Provide it proactively: Offer B2B customers the report directly when they send a security questionnaire, together with an up-to-date bridge letter if the new report is not yet available.

Conclusion

A SOC 2 report is only as valuable as your own review of it. Read the auditor's opinion first, then the scope and the exceptions, and check the controls the report expects from you as a customer. With the 8-point checklist, you can tell within minutes whether a vendor really delivers what the cover page promises.

With heyData's vendor risk management, you can collect your vendors' evidence in one place, assess their risks in a structured way and keep track of deadlines such as expiring audit periods.