(518) 292-4500
MSP 501 Winner 2025
Cybersecurity GlossaryWhat is SOC 2?
SOC 2 is an auditing framework developed by the AICPA that evaluates a service organization’s controls against five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. SOC 2 reports are commonly requested by B2B customers as evidence that their vendor handles data responsibly.
How SOC 2 works
Three-step view of how it operates in practice.
Scope & readiness
Define which services and systems are in scope. Run a readiness assessment to identify control gaps.
Remediate & document
Implement missing controls, document policies, and ensure evidence is collected consistently.
Audit
An independent CPA firm evaluates the controls. Type I is a point-in-time check; Type II observes controls operating over a 6-12 month period.
SOC 2 Type I vs Type II vs SOC 3
A clear breakdown of the common variants.
SOC 2 Type I
Controls designed and implemented at a specific date. Quicker to achieve; less rigorous.
SOC 2 Type II
Time-based one-time codes from an app like Microsoft Authenticator or Google Authenticator. Offline-capable and phishing-resistant against many attacks.
SOC 3
The user approves a sign-in with a tap on their phone. Easy to use but vulnerable to MFA fatigue attacks — always pair with number matching.
Trust Services Criteria
FIDO2 keys like YubiKey, or device-bound passkeys. Phishing-resistant by design — the key will not authenticate against a fake domain.
Why SOC 2 matters for SMBs
SOC 2 is an auditing framework developed by the AICPA that evaluates a service organization’s controls against five Trust Services Criteria: Security,…
Common SOC 2 mistakes
- Starting with the audit, not readinessSkipping readiness means finding control gaps during the audit — which blows the timeline and budget.
- Documentation without implementationAdmins, finance, and anyone with access to money or sensitive data should use an app or hardware key — never SMS alone.
- Treating it as one-timeSOC 2 Type II is an annual cycle. Building control execution into daily operations beats annual scramble.
- Over-scopingIncluding every system and service in the initial scope makes the audit unwieldy. Start scoped, expand over time.
SOC 2 frequently asked questions
LogicalNet services related to MFA
Related glossary terms
Customers asking for a SOC 2 report?
Talk to a LogicalNet identity expert. We will review your current environment, recommend the right MFA methods for each group of users, and help you deploy without disrupting the business.