Compliance and security demand precision, especially when data, assets, and huge investments are on the line. Even the way we talk about compliance deserves consideration because language sets the precedent for what actually happens in the world.

‍

Without getting too philosophical, let’s consider the semantics around SOC 2 Type I and Type II compliance. Specifically, what’s the difference between SOC 2 attestation and certification, and why does it matter? Let’s hash it out.

‍

‍

{{cta_withimage1="/cta-blocks"}}

The SOC 2 certification dilemma

You don’t have to Google too hard to find the phrases “SOC 2 certified” or “SOC 2 certification.” LinkedIn posts, blog announcements, and PR headlines all seem to be typical places to communicate the win, and you definitely should communicate it.

Achieving compliance success is a proud moment for any business, and one worth shouting across the rooftops. Investing the time and effort to plan, prioritize, and finally receive a SOC 2 report is a venerable benchmark of progress. But there’s a catch.

‍

Technically, there’s no such thing as “SOC 2 certification.” Every time you’ve heard it or read it, it’s been wrong. A more detailed look into compliance jargon across the internet will also reveal another, more accurate phrase: “SOC 2 attestation.”

‍

What is SOC 2 attestation?

The vast majority of companies that have a SOC 2 are not under a legal or regulatory requirement to do so. In other words, SOC 2 is not a mandatory security framework. It is a voluntary attestation, which is then proven by a third-party auditor. That proof is your SOC 2 report — a living document providing interested parties information about your company’s commitment to security.

Since any licensed CPA can perform your SOC 2 audit, there is no certifying body. The American Institute of CPAs (AICPA) designs the SOC 2 standards, but it does not grant certifications.

‍

This means there is no universally accepted SOC 2 certification. When a CPA reviews your company, there is no “pass or fail.” An auditor is simply an objective reference providing a report, for better or worse, that testifies to the state of your company’s security posture. “Failure” in SOC 2 generally comes in the form of a “qualified opinion,” meaning the auditor is telling the reader that your controls, or their execution, do not meet these particular criteria.

‍

When a prospect or vendor inquires about your company’s security, they are asking for your attestation, not a certification. With this understanding in mind, your typical celebratory SOC 2 announcement headline should change.

From this: Llama Time, Inc. completes SOC 2 certification!

To this: Llama Time, Inc. successfully receives SOC 2 Type II attestation report.

To give a little more context, it also helps to understand what companies are actually attesting when it comes to SOC 2. Here’s a quick breakdown of the difference between SOC 2 Type I vs. SOC 2 Type II.

‍

SOC 2 Type I attestation

SOC 2 Type I is a point-in-time, static snapshot that captures your business’s compliance frameworks as of a certain date or point in time. When an auditor is reviewing your business, they will investigate that snapshot to see whether or not the appropriate controls are present. Whether or not the controls are accurately present, an auditor will attest to, not certify.

‍

SOC 2 Type II attestation

SOC 2 Type II is a compliance review that takes place over a period of time, usually six to twelve months, in contrast to a point-in-time snapshot. The auditor will collect evidence and investigate the operating effectiveness of your business’s controls over the period. This is the reason why Type II is more intensive and expensive, but it’s also why it’s more meaningful. Just like Type I, an auditor will produce an objective report, not a certification, that is neither “pass nor fail.”

{{cta_simple1="/cta-blocks"}}