SOC 2 is not a certificate but a report by an independent auditor on a service provider’s controls. It comes from US audit practice, where it is almost standard for SaaS providers.
Trust Services Criteria
Security is mandatory. Depending on the service, availability, processing integrity, confidentiality and privacy are added. The provider describes its system and controls, and the auditor assesses them.
Type 1 and Type 2
A Type 1 report assesses whether controls are suitably designed at a point in time. A Type 2 report additionally tests whether they operated effectively over a period, typically several months. Customers usually ask for Type 2.
SOC 2 or ISO 27001
In Europe ISO 27001 is more common, in the US SOC 2. Their content overlaps heavily; a well-built ISMS provides much of the evidence for both. For European providers, SOC 2 mainly pays off when key US customers explicitly require it.
A practical route
Companies needing security evidence usually start with an ISMS and answer customer questionnaires. How to approach that is described in our offer on security questionnaires.