SOC 2 Foundations & Overview

Start here to understand what SOC 2 is, the report types, the SOC family, and how to get ready. ← Back to SOC 2: The Complete Guide

Guide	What you'll learn
SOC 2 Complete Guide: AICPA Trust Services Criteria	The standard from scratch — attestation, TSC, how it works
SOC 2 Type I vs Type II	Design vs operating effectiveness; which to choose
SOC 2 Trust Services Criteria Explained	The five criteria overview
SOC 2 vs SOC 1 vs SOC 3	The SOC report family
SOC 2 Business Benefits	The business case for service organizations
SOC 2 Readiness Assessment	Pre-audit preparation
SOC 2 Report Structure	The auditor's report and its sections
SOC 2 Common Controls & Shared Responsibility	The Common Criteria baseline; who owns what
SOC 2 Complementary Controls (CUEC/CSOC)	Client and subservice responsibilities
SOC 2 Management Assertion	Owning your controls
SOC 2 Scope Definition	Determining what's in and out
SOC 2 Observation Period	The Type II review timeframe
SOC 2 Bridge Letter	Covering the gap between reports
SOC 2 Report Distribution	Sharing the report (restricted use)
SOC 2 User Entity Controls	Documenting client responsibilities

Resources: Readiness Quiz · Readiness Checklist · Glossary

Frequently asked questions