How is a SOC 2 Type 2 report structured?

SOC 2 reports follow a very specific and consistent structure, and Type 2 reports are broken down into 4 key elements.  The first of these elements is the auditor’s report, where the auditor details what they have done and their opinion of your system and service(s), i.e., whether it is a qualified or unqualified report.  The second element is an attestation letter from your organisation’s senior management, confirming that all the information provided during the audit is accurate, whilst the third is a description of your ‘system’.  The final element of the report is the auditor’s tests of the operational effectiveness of your controls.  

The third element of a SOC 2 report, the ‘system description’, is divided into two sections:

• Company Background
• Description of Services Provided
• Principal Service Commitments and System Requirements
• System Components
• System Boundaries

The Control Environment

• Control Environment
• Risk Assessment Process
• Information and Communications Systems
• Monitoring Controls
• System Changes Since Last Review
• Incidents Since Last Review
• Subservice Organisations
• Complementary User Entity Controls.

These two sections reflect the two key aspects of the SOC 2 audit and report.  On the one hand, SOC 2 considers the detail of your information security processes and controls, and how your service(s) align with each of the selected TSC, which is covered by the Overview of Operations.   However, SOC 2 also looks at your organisation more broadly, which is reflected in the Control Environment section.