Is SOC 2 a certification? No, and here is what to ask for instead
No. SOC 2 is an attestation, not a certification. A CPA firm examines your provider's controls against the AICPA's Trust Services Criteria and issues a report with an opinion. No body awards a SOC 2 certificate. Ask for the report, then read its scope section and its observation period.
- SOC 2 is an attestation. A CPA firm examines controls and signs a report, and no certification body awards a SOC 2 certificate.
- ISO 27001 is a certification. ISO and IEC define certification of a management system as a third-party conformity assessment activity.
- The report is the deliverable, and the scope section decides whether it covers anything you buy.
- A completely genuine SOC 2 Type II can cover systems your data never touches, over a period that ended ten months ago.
- Federal bank regulators ask whether a SOC report's scope and results are relevant to the activity performed. Use the same test on your provider.
How did we compare SOC 2 and ISO 27001?
We compared them against the two bodies that define the words. Compliance vendors write most of what ranks for this question, and a paraphrase of a standard is not the standard.
- The sources. The AICPA writes the Trust Services Criteria and the SOC 2 reporting standards. ISO and IEC define certification. We quote both in their own words.
- The exclusions. We name no provider and say nothing about which firms in our directory hold which report.
- Not audit or legal advice. Your auditor and your counsel own the final call on your obligations.
- Independence. Best IT MSP is an independent directory. We rank on verified rating and firmographic data, we label paid placement, and we do not sell IT services.
A provider that advertises itself as SOC 2 certified is usually repeating the phrase its own buyers use. The fix is a better question, not an accusation.
Is SOC 2 a certification?
No. SOC 2 is an attestation, which means an independent CPA firm examines a provider's controls and publishes an opinion about them. The AICPA, which owns the standard, presents the Trust Services Criteria as control criteria established by the AICPA's Assurance Services Executive Committee for use in attestation or consulting engagements. It describes SOC itself as a suite of service offerings CPAs may provide in connection with system-level controls of a service organization.
Nothing in that description is a certificate. No certification body stands behind SOC 2, no public register exists to search, and no authority can suspend a badge. The AICPA titles its own guidance an examination of controls relevant to security, availability, processing integrity, confidentiality, or privacy, which is the language of an audit opinion, not a pass mark.
SOC 2 is also voluntary. No law requires it, and your fellow customers are the enforcement mechanism. So a provider never gets certified under SOC 2. A CPA firm attests, the provider receives a report, and you read it. That shift, from badge to document, changes what you should ask for.
What does attestation mean in the AICPA's own words?
Attestation means a licensed CPA firm reports on someone else's claim about their own controls. Management writes a description of the system and asserts that its controls met the criteria. The service auditor then tests those controls and signs the opinion. The AICPA's illustrative report is written to meet the reporting requirements of SSAE-21, effective for service auditor reports dated on or after June 15, 2022.
That is why the deliverable is called an attestation report. It records who asserted what, across which systems, and for which dates.
Why providers say SOC 2 certified
Marketing shorthand explains most of it. Buyers ask whether a provider is certified. Procurement forms carry a field labelled certifications. Sales teams fill that field with the closest true thing the firm holds. Treat the phrase as a prompt to ask one more question, not as a reason to walk away.
How is ISO 27001 different from SOC 2?
ISO 27001 is a certification, which is the fastest way to see what SOC 2 is not. ISO/IEC 17021-1, the standard governing the bodies that do this work, states that certification of management systems is a third-party conformity assessment activity and sets requirements for the competence, consistency and impartiality of bodies providing audit and certification. Those bodies are accredited to issue certificates, and a certificate states the scope it covers and the dates it is valid for.
The requirement sets differ too. ISO/IEC 27001:2022 says plainly that excluding any of the requirements specified in Clauses 4 to 10 is not acceptable when an organization claims conformity. A SOC 2 is built the other way round. Security sits in every report, and the other four categories of the Trust Services Criteria are added only when the provider or its customers want them.
| Dimension | SOC 2 | ISO 27001 |
|---|---|---|
| What it is | An attestation examination under AICPA standards | Certification of a management system |
| Who performs it | A CPA firm acting as service auditor | A certification body, itself accredited |
| What you receive | A report with an opinion, the tests run and their results | A certificate naming the certified scope |
| How scope is set | The provider selects the criteria categories and the systems described | Clauses 4 to 10 all apply, and the certificate states the management system scope |
| Time basis | Type I at a single date, Type II across a stated observation period | A certificate with stated validity dates |
| What a buyer asks for | The full report, usually under a non-disclosure agreement | The certificate plus its scope statement |
Neither one escapes the scope question. An ISO 27001 certificate names the information security management system it covers, which can be narrow enough to exclude the service you buy. A SOC 2 report names the systems the auditor examined. Read the scope on both, every time.
What do you actually receive, and which part matters?
You receive a report, and the scope section is the part that matters. Four parts of it matter to a buyer. The auditor's opinion, management's assertion, the description of the system, and the auditor's tests with their results.
The description of the system is where the scope lives. It names the services, the platforms, the locations, and the subservice providers that were carved out of the examination. A Type II report then states the observation period, which is the window the auditor tested across. A Type I describes the design of controls at one date instead.
Here is the part most buyers miss. A provider can hold a completely genuine SOC 2 Type II that covers none of the systems your data sits in. The report is accurate and the opinion is clean. It is about something else, because the provider chose the scope and the auditor reported on exactly that.
The report also hands you homework. Most describe controls the provider expects its customers to run, called complementary user entity controls. Those typically include removing leavers quickly and approving administrator access. If nobody on your side operates them, the provider's opinion still stands and your gap is still open.
How do you read a SOC 2 report in 15 minutes?
To read a SOC 2 report quickly, work through five checks in this order.
- Read the opinion. It sits near the front. An unqualified opinion means the auditor found the controls met the criteria. A qualified opinion means they did not in some stated respect, and the words except for mark the spot.
- Check the dates. Find the observation period and the report date. A period that closed ten months ago tells you about last year, not about this quarter.
- Compare the scope with your invoice. List the services you pay for, then find each one in the description of the system. Anything you cannot find there was not examined.
- Hunt the exceptions. The results section lists the deviations the auditor found, with management's response to each. A remediation date in the future does not undo a deviation in the past.
- Ask for your own list. Pull out the complementary user entity controls and hand them to whoever owns them inside your business.
One extra question covers a stale period. If the window closed more than three months ago, request a bridge letter. A bridge letter is the provider's own statement about the gap, signed by management rather than by the auditor, so it carries no opinion. That is context, not evidence.
A clean opinion on the wrong systems is not assurance. It is a well-audited answer to a question you did not ask.
Why does a provider's report matter to your business?
Because your IT provider is a third party holding administrator access to everything you own. Verizon's 2026 report found that breaches involving a third party now account for 48% of all breaches, after third-party supply chain breaches jumped 60% in a single year. CISA, the NSA and the FBI warned that threat actors can use a vulnerable MSP as an initial access vector to multiple victim networks.
The cost is not theoretical. IBM puts the global average cost of a data breach at USD 4.99 million and finds it takes an average of 247 days to identify and contain an active breach. Hold that against a three month observation period and the limit of any report becomes clear. An intrusion can run longer than the window the auditor tested.
Controls also decay between reports. Verizon found only 26% of critical vulnerabilities in the CISA known exploited catalog were fully remediated in 2025, down from 38% the year before, and that the median time for full resolution went up to 43 days. A clean report covering last spring says nothing about an unpatched firewall this month.
Regulators apply the test we are recommending. The 2023 interagency guidance for US banking organizations tells them to review System and Organization Control (SOC) reports and to consider whether the scope and the results of the SOC reports, certifications, or assessments are relevant to the activity to be performed. That is a vendor risk review in one sentence.
What should you ask your provider this week?
Ask four questions in writing, then keep the answers on file.
- Request the report. Ask for the most current SOC 2 Type II report in full, under a non-disclosure agreement if the provider needs one. A firm that holds one usually sends it within a day.
- Verify the scope. Ask which of the services on your invoice appear in the description of the system, and which subservice providers were carved out.
- Check the period. Ask for the observation period, the report date, and a plain explanation of every exception the auditor recorded.
- Confirm who owns what. CISA advises that contracts specify whether the MSP or the customer owns specific responsibilities, so settle that in the contract rather than in an email thread.
Two caveats keep this fair. A provider with no SOC 2 report is not automatically unsafe, because the examination costs real money and plenty of good small firms have never bought one. A report is also not a contractual promise to you, and it is not a business associate agreement.
For the wider map, read HIPAA vs CMMC vs SOC 2 next, then our cybersecurity compliance guide for the build order, and the ISO 27001 compliance checklist if a customer is pushing you to certify. No report makes a provider safe, and no honest provider claims otherwise. The report moves you from trusting a logo to reading evidence.
FAQ
Is SOC 2 a certification?
No. SOC 2 is an attestation. The AICPA presents its Trust Services Criteria as control criteria for use in attestation or consulting engagements, and the work is performed by CPAs in connection with system-level controls of a service organization. You receive a report carrying an auditor's opinion, not a certificate from a certification body.
Can a company be SOC 2 certified?
No, because no body issues a SOC 2 certificate. A company holds a SOC 2 report signed by a CPA firm and written to the SSAE-21 reporting requirements. Most providers who say certified mean they hold a current Type II report. Ask for the report and the wording stops mattering.
What is the difference between a SOC 2 attestation and ISO 27001 certification?
ISO 27001 is awarded by a certification body. ISO/IEC 17021-1 calls certification of management systems a third-party conformity assessment activity, and ISO/IEC 27001:2022 states that excluding any of the requirements specified in Clauses 4 to 10 is not acceptable. SOC 2 instead produces a CPA firm's opinion on criteria the provider selected.
Is a SOC 2 Type II better than a Type I?
Yes, for judging a provider you depend on. A Type I describes the design of controls at one date, while a Type II tests whether they operated across a stated observation period. Check the period and the report date, because IBM measures an average of 247 days to identify and contain a breach, longer than many audit windows.
How do I verify a provider's SOC 2 report?
Request the full report under a non-disclosure agreement, then read the opinion, the observation period, the description of the system and the exceptions. Federal bank regulators apply the same test, asking whether the scope and the results of the SOC reports, certifications, or assessments are relevant to the activity to be performed.
Best IT MSP is the independent directory of managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on rating and verified data, and paid placement is always labelled. Shortlist three firms in your city, then ask all three the same four questions.