A SOC 2 report is an independent CPA firm's opinion on whether a company's security controls are designed well and actually work.
Customers ask for it before they trust you with their data. If a prospect just asked for yours and your team is wondering what is a SOC 2 report, exactly, this guide shows what it contains, what each section looks like, and how customers read it.
In short, the SOC 2 report meaning is outside proof that your security works.
Reviewed by Riya Ann Varghese, GRC Engineer, ISO 27001 lead auditor certified. Last updated: November 5, 2026.
What Is a SOC 2 Report?
A SOC 2 report is an attestation report, signed by a licensed CPA firm, on how a service company protects customer data.
The AICPA (the US body for accountants) sets the rules. SOC 2 audits follow its attestation standards, known as SSAE 18 and updated by SSAE 21 in 2022, as Linford & Co. explains. The report is checked against five Trust Services Criteria:
- Security (always required): systems are protected against unauthorized access.
- Availability: systems are up and usable as promised to customers.
- Processing integrity: processing is complete, accurate and authorized.
- Confidentiality: confidential information is protected.
- Privacy: personal information is collected, used and deleted properly.
- Who writes it: an independent CPA firm. Your team writes the system description and assertion; the auditor writes the opinion and the test results.
- What it is not: a certificate. People say "SOC 2 certified", but a SOC 2 audit report is an opinion, not a pass or fail badge.
- Two types: a Type 1 report checks control design on one date. A SOC 2 Type 2 report tests whether controls worked over a period of 3 to 12 months, most often 6 to 12.
For the framework itself, see what SOC 2 is.
Who Needs a SOC 2 Report?
Any company that stores or processes customer data for other businesses usually needs a SOC 2 report once larger customers start asking for one.
SaaS, cloud, fintech and health tech companies are typical. SOC 2 is not legally required, but procurement teams ask for it and deals stall without it.
What Does a SOC 2 Report Look Like? The 5 Sections
A SOC 2 report has four required parts plus an optional fifth section from management.
The four parts are the auditor's report, management's assertion, the system description, and the tests of controls.
The AICPA says the format is not fixed, so the order can vary by audit firm. Most reports put the auditor's opinion first.
| Section | Who writes it | What it says | What readers check |
|---|---|---|---|
| 1. Independent service auditor's report | CPA firm | The opinion: were controls designed well (and, for Type 2, did they operate effectively)? | Opinion type, report period, auditor name and signature date |
| 2. Management's assertion | Your company | Your formal statement that the system description is accurate and controls met the criteria | That it matches the period and scope in Section 1 |
| 3. System description | Your company | What is in scope: services, infrastructure, software, people, data, and third parties | Whether the product they buy is actually covered |
| 4. Criteria, controls, tests and results | CPA firm (tests), your company (controls) | Each control, how the auditor tested it, and the result | Exceptions, sample sizes, and complementary user entity controls |
| 5. Other information (optional) | Your company | Extra context, such as responses to exceptions or future plans. Not audited. | Management responses to any exceptions |
The system description must follow the AICPA's description criteria (known as DC 200). So every report covers the services, system components, commitments to customers, and subservice organizations such as a cloud host.
Section 4: Controls, Tests and Results
Section 4 is a table of every control, the test the auditor ran, and the result.
Most rows end with "No exceptions noted." When something went wrong, the result says so, as in the example below.
Auditors usually test a sample, not every event. A Type 1 report only checks that controls were in place on one date.
What Are the 4 Types of SOC 2 Opinions?
A SOC 2 opinion is one of four types: unqualified, qualified, adverse, or a disclaimer of opinion.
| Opinion | What it means | How customers usually react |
|---|---|---|
| Unqualified (clean) | Controls were suitably designed and, for Type 2, operated effectively | Accepted. They still read any exceptions |
| Qualified | A specific problem was material, but not everywhere | Questions about the affected area and your fix |
| Adverse | Problems were material and widespread | Serious concern; deals often pause |
| Disclaimer of opinion | The auditor could not get enough evidence to form an opinion | Treated like an adverse opinion until explained |
A clean opinion does not mean zero findings. A report can be unqualified and still list exceptions, because the auditor decided they did not break the criteria. The four opinion types are set by the AICPA attestation standards, as Linford & Co., a CPA firm, explains. For what to do when exceptions show up, read our guide to SOC 2 exceptions.
Not sure what your first report will say? Talk to a compliance expert and we'll walk through your scope before the audit starts.
CUECs, CSOCs and Subservice Organizations
Complementary user entity controls (CUECs) are the controls your customers must run on their side for your controls to work.
A common CUEC is "Customers remove access for their own users who leave."
Subservice organizations are vendors you rely on, such as AWS. Reports handle them in two ways:
- Carve-out method (most common): the report describes what AWS does but does not test its controls. It lists complementary subservice organization controls (CSOCs), such as data center security, that AWS is expected to run. The reader then checks AWS's own SOC 2 report.
- Inclusive method: the vendor's controls are described and tested inside your report. This is rare.
See Linford & Co.'s guide to the inclusive and carve-out methods.
SOC 2 Report Example: Where to See a Real One
A real SOC 2 report example is hard to find in public, because companies share their reports only under NDA.
You have three honest options:
- The AICPA illustrative report. The AICPA publishes an illustrative SOC 2 report with a sample system description and assertion. It is available to members and is the closest thing to an official SOC 2 sample report.
- Trust pages of large vendors. Big cloud and SaaS companies let customers request their SOC 2 report through a trust portal.
- Ask a vendor you already work with. Most will send their report after you sign an NDA.
Below, you'll see how to read a SOC 2 report quickly.
Is There a SOC 2 Report Template?
There is no official SOC 2 report template you fill in yourself.
The AICPA illustrative SOC 2 sample report is a reference, not a form. The auditor produces the report. You write the system description and assertion, and the description criteria set what they must contain, not a fixed layout.
How to Read a SOC 2 Report (and How Customers Will Read Yours)
To read a SOC 2 report, start with the opinion and the period, then check scope, exceptions and the controls left to you.
Most reports run to dozens of pages, but a reviewer can cover the important parts in about 15 minutes, in this order:
- Opinion. Is it unqualified? If not, stop and read why.
- Report type and period. Type 1 or Type 2? For Type 2, how long was the period, and when did it end?
- Scope. In the system description, is the product you buy covered? Which Trust Services Criteria are in scope?
- Exceptions. In Section 4, search for "exception" or "deviation". Note what failed, how often, and how serious the control is.
- Management responses. Is there a real fix with a date, or a vague one-liner?
- CUECs. List the controls your own team must run.
- Subservice organizations. Which vendors were carved out? Get their reports too.
- The auditor. Is the firm a licensed CPA firm in good standing?
Red flags include a period that ended over 12 months ago, a scope that leaves out the product you use, and missing criteria you care about, such as privacy.
If you are the company being audited, expect customers to read your report in exactly this order. Fix weak spots in scope and evidence before your period starts, not after.
How to Get a SOC 2 Report and What It Costs
To get a SOC 2 report, you prepare your controls, run them, and hire a licensed CPA firm to audit them.
- Scope: pick the product, systems and Trust Services Criteria.
- Readiness: close gaps in policies, access, logging and vendor management.
- Choose an auditor: compare a few SOC 2 audit firms.
- Audit: the CPA firm tests your controls, then writes the SOC 2 audit report.
The audit fee for a SOC 2 Type 2 report is about $5,000 to $20,000 for a small company with a focused scope. See the full breakdown of SOC 2 audit costs and the step-by-step SOC 2 audit process.
How Long Does It Take to Get a SOC 2 Report?
A first SOC 2 Type 2 report usually takes about a year from a standing start.
- Readiness: fixing gaps before the audit period starts. Teams with few gaps move faster.
- Type 1 option: checks controls on one date, with no waiting period, so it can unblock a deal sooner.
- Type 2 period: 3 to 12 months of controls running, most often 6 to 12.
- Report: usually ready a month or two after the period ends, according to Linford & Co.
No SOC 2 Report Yet? What to Send Customers While You Wait
If you don't have a SOC 2 report yet, send customers proof of progress instead of a promise.
- A Type 1 report, if you can get one before the deal closes.
- A short timeline naming your audit firm and the date your Type 2 period starts.
- A completed security questionnaire that maps your controls to their questions.
- A trust center page that lists your controls and policies.
Once you have a report, a bridge letter covers the gap between one report and the next.
Who Can See Your SOC 2 Report?
A SOC 2 report is a restricted-use document, shared only with customers, prospects and their auditors, usually under an NDA.
A SOC 3 report is the short, general-use version you can post publicly, without the detailed test results. Many companies also run a trust center that releases the full report after an NDA is signed.
How UprootSecurity Helps You Get and Share Your SOC 2 Report
UprootSecurity gets you ready for the SOC 2 audit, collects evidence during the period, and helps you share the report safely. We introduce you to independent audit firms; the CPA firm does and signs the audit.
| What your customer asks for | How UprootSecurity delivers it |
|---|---|
| "Send us your SOC 2 report" | Readiness, evidence collection and auditor introductions to get your first report |
| "Which of your controls cover us?" | 140+ integrations that collect evidence automatically for your system description and tests |
| "Fill in our security questionnaire" | Questionnaire automation on Growth and Enterprise plans |
| "Share it under NDA" | A trust center on Growth and Enterprise plans |
| "We also need ISO 27001 or HIPAA" | 22 frameworks on one platform, with a dedicated compliance expert |
| "Do you run a penetration test?" | A yearly pentest is included |
Customer waiting on your SOC 2 report? → Book a demo today
Frequently Asked Questions
You get a SOC 2 report by preparing your security controls and hiring a licensed CPA firm to audit them. First set your scope and close gaps, then the auditor tests your controls on one date (Type 1) or over 3 to 12 months (Type 2) and issues the report.
Only a licensed, independent CPA firm can issue a SOC 2 report. Consultants and compliance platforms can prepare you for the audit, but they cannot sign the opinion. Check that the firm is in good standing and has experience with companies like yours.
A SOC 1 report covers controls that affect customers' financial reporting, while a SOC 2 report covers security and data protection. Payroll and billing companies often need SOC 1. SaaS and cloud companies that hold customer data usually need SOC 2. Some companies need both.
A SOC 3 report is a short, public version of a SOC 2 report. It includes the auditor's opinion but leaves out the detailed system description and test results. Companies post it on their website, while the full SOC 2 report stays behind an NDA.
No, SOC 2 Type 2 reports are not public. They are restricted-use documents shared with customers, prospects and their auditors, usually after an NDA is signed. Companies that want a public document use a SOC 3 report or a trust center page instead.
You cannot fail a SOC 2 audit in a pass or fail sense, because the result is an opinion. But a qualified, adverse or disclaimer opinion tells customers something went wrong. A few exceptions with a clear fix usually still allow a clean opinion.
A SOC 2 report is usually accepted for 12 months after its period ends. It has no official expiry date, but customers expect a new report every year. If there is a gap before the next report, a bridge letter covers it.
A SOC 2 report has no official page count, but most run to dozens of pages. Length depends on scope, the number of controls, and whether it is Type 1 or Type 2. Type 2 reports are longer because they include every test and result.
No, SOC 2 is not legally required by any law. It is a voluntary standard from the AICPA. In practice, enterprise customers and procurement teams often make a SOC 2 report a condition of buying, so it becomes a business requirement.
A SOC 2 Type 2 report tests every control in scope, but usually checks a sample of events for each one. For example, the auditor may inspect 25 of 112 new hires. The sample size depends on how often the control runs during the period.
