AICPA attestation

SOC 2: AICPA attestation report on the Trust Services Criteria, Type I and Type II

In a Type II report the auditor assesses controls over an observation period, usually three to twelve months: evidence is needed for the whole period.

Let's talkStarting assessment

SOC 2 is an attestation report issued by an independent auditor under AICPA standards. It describes a service organisation's controls against the Trust Services Criteria and is often requested by customers, especially in North America. A Type II report assesses the operating effectiveness of controls over a period.

Who it applies to

  • Software, cloud and data processing service providers handling customer data.
  • Companies selling to customers who ask for a SOC 2 report, often in the United States.
  • Organisations with ISO/IEC 27001 that want to reuse most of their controls.

What it requires

  1. 01

    Security

    Always included: protection against unauthorised access, disclosure and damage to systems.

  2. 02

    Availability

    Optional criterion on system availability against commitments.

  3. 03

    Processing integrity

    Optional criterion on complete, accurate and timely processing.

  4. 04

    Confidentiality and privacy

    Optional criteria on confidential information and personal data.

  5. 05

    Type I and Type II

    Type I assesses control design at a point in time; Type II their effectiveness over a period, usually three to twelve months.

EVIDEVO

How EVIDEVO manages controls and evidence for SOC 2

Evidence across the observation period

Each control collects dated evidence across the period, with alerts on due dates.

Reuse of ISO/IEC 27001

Shared controls carry over the evidence already collected.

Auditor requests

In Audits and reviews, auditor requests are linked to controls and evidence, with the status of every response.

Documented exceptions

Deviations and corrective actions are recorded with date, rationale and owner.

Data for illustrative purposes only, not real

What can be exported

  • Evidence by criterion and by control
  • Samples across the observation period
  • Status of auditor requests

Capabilities for SOC 2

How to determine whether SOC 2 applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Guides on SOC 2

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk