# SOC 2

> AICPA Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy, and how to set it up in cSquare.

Source: https://docs.csquaregrc.com/frameworks/soc-2


SOC 2 is an attestation against the AICPA **Trust Services Criteria**. Security (the Common Criteria) is required; availability, processing integrity, confidentiality and privacy are optional.

## Type I and Type II

- **Type I** tests control design at a point in time.
- **Type II** tests operating effectiveness over a period, usually 6 to 12 months.

Many teams do a Type I first, then start the Type II observation period immediately after.

## Set up SOC 2 in cSquare

1. **Create the program** from the SOC 2 template and choose your criteria.
2. **Define the system** in scope: products, infrastructure, people and data.
3. **Scope controls** with the Control Applicability Wizard. Mark controls inherited from your cloud provider.
4. **Connect evidence sources** early: identity provider, cloud, code host and ticketing. Much Type II evidence is collected continuously.
5. **Approve core policies**: information security, access control, change management, incident response, vendor management, business continuity.
6. **Upload prior reports** to Document Intelligence to pre-populate findings.
7. **Run a readiness review** before booking the auditor.

```text
Set up a SOC 2 plan for us: which Trust Services Criteria we should include beyond Security given our organization profile, Type I or Type II first, and a 12-week timeline to readiness.
```

## Evidence auditors usually ask for

- User access reviews and onboarding/offboarding records.
- MFA enforcement and password settings.
- Change approvals and code review history.
- Logging and monitoring configuration and alerts.
- Vulnerability scans and remediation records.
- Policy approvals and employee acknowledgements.
- Vendor assessments for critical vendors.

```text
For my SOC 2 program, list each control that still lacks evidence for the current observation period, and tell me which connector or upload would provide it.
```

## Reuse

SOC 2 maps closely to ISO 27001. See [Control mapping](/concepts/control-mapping).