标准简介
SOC 2（服务组织控制 2）Type II 是由美国注册会计师协会（AICPA）为存储、处理或传输客户数据的服务组织开发的审计标准。它基于信任服务标准（TSC）评估与安全性、可用性、处理完整性、保密性和隐私相关的组织信息系统。与评估某一时间点控制的 Type I 报告不同，Type II 报告检查这些控制在一段时间（通常为 6-12 个月）内的运营有效性。
SOC 2 Type II 合规已成为 SaaS 公司、云服务提供商、数据中心和其他技术服务组织展示其对数据安全和隐私承诺的必要条件。该框架涵盖五个信任服务标准：安全性（基础性，所有组织都需要）、可用性、处理完整性、保密性和隐私。组织根据其服务选择适用的标准。独立的注册会计师进行严格的审计，以验证控制设计合理并有效运行，为客户、合作伙伴和利益相关者提供敏感数据根据行业最佳实践得到保护的保证。
Trust Services Criteria
Evaluates controls across five categories: security (always required), availability, processing integrity, confidentiality, and privacy.
Type II Over Time
Unlike point-in-time assessments, Type II examines the operating effectiveness of controls over a minimum 6-month period.
CPA-Issued Report
Only licensed CPA firms can issue SOC 2 reports under AICPA attestation standards, giving them legal weight and market credibility.
list_alt Trust Services Criteria
- Security (Common Criteria) — always required
- Availability — uptime and disaster recovery
- Processing Integrity — accurate, complete processing
- Confidentiality — protection of sensitive data
- Privacy — personal information handling
- Logical and physical access controls
- Change management and risk assessment
- Monitoring and incident response
Who Needs to Comply?
SaaS companies, cloud providers, data centers, and any technology service organization that stores or processes customer data. Increasingly expected by enterprise buyers during vendor due diligence.
Key Requirements
Control Environment
Demonstrate a commitment to integrity, ethical values, and competence. Define organizational structure, authority, and responsibility for internal controls.
Logical Access Controls
Implement role-based access, multi-factor authentication, and least-privilege principles. Regularly review and revoke access for terminated employees.
Change Management
Establish formal procedures for authorizing, testing, approving, and implementing changes to infrastructure, software, and configurations.
Incident Response
Define and test incident response procedures. Document incidents, root cause analysis, remediation actions, and communication to affected parties.
Vendor Management
Assess and monitor third-party service providers. Ensure sub-service organizations maintain controls consistent with your SOC 2 commitments.
Penalties & Enforcement
No legal penalties — SOC 2 is a market-driven attestation. However, failing to obtain or maintain a SOC 2 report can result in lost deals, especially with enterprise and financial sector customers who require it contractually.