What is a typical SOC 2 report scope?

Whilst many frameworks and certifications, such as ISO 27001, typically expect you to certify your entire organisation or a key branch of your organisation, the scope of a SOC 2 report is limited to the delivery of specific services that involve processing client data.   For example, if your organisation offers a number of services, but only a few of those services have clients requesting a SOC 2 report, you could undertake a SOC 2 audit purely on those few services and exclude the others.  

Your SOC 2 report is aimed at assuring the system that delivers your service, which  consists of everything you do and utilise to support the delivery of the in-scope service(s).   This will include service-specific elements, such as how the service is developed, the back-office functions that support it, how the service is technically secured, etc.  However, the system will also include wider, governance-related aspects that are relevant to your organisation more broadly, such as information about HR processes, how risk is managed, and how communications are managed.