Vanta automates security compliance.
Please enter your first name
Please enter your last name
Please enter a valid email address
Please enter a job title
Please enter your company name
Please enter your company website
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

SOC 2 compliance: Attestation vs. certification, and why it’s important to get it right

September 9, 2022

Compliance and security demand precision, especially when data, assets, and huge investments are on the line. Even the way we talk about compliance deserves consideration because language sets the precedent for what actually happens in the world.

Without getting too philosophical, we want to briefly take the opportunity to discuss common terms surrounding SOC 2 Type I and Type II compliance. Specifically, what’s the difference between attestation and certification?

Semantics aside, it doesn’t really seem important at first glance, but ignoring semantics in the realm of compliance can be costly in every sense of the word. So what is the difference and why does it matter? Let’s hash it out. 

The SOC 2 certification dilemma 

You don’t have to Google too hard to find the phrases “SOC 2 certified” or “SOC 2 certification.” LinkedIn posts, blog announcements, and PR headlines all seem to be typical places to communicate the win, and you definitely should communicate it.

Achieving compliance success is a proud moment for any business, and one worth shouting across the rooftops. Investing the time and effort to plan, prioritize, and finally receive a SOC 2 report is a venerable benchmark of progress. But there’s a catch. 

Technically, there’s no such thing as “SOC 2 certification.” Every time you’ve heard it or read it, it’s been wrong. A more detailed look into compliance jargon across the internet will also reveal another, more accurate phrase: “SOC 2 attestation.” 

What is SOC 2 attestation?

The vast majority of companies that comply with SOC 2 are not under a legal or regulatory requirement to do so. In other words, SOC 2 is not a mandatory compliance framework. It is a voluntary attestation, which is then proven by a third-party auditor. That proof is your SOC 2 report—a living document providing interested parties information about your company’s commitment to security.

Since any CPA can attest to being compliant with SOC 2 controls, there is no certifying body. The American Institute of CPAs (AICPA) designs the SOC 2 standards, but it does not award certifications. 

Therefore, there is no universally accepted SOC 2 certification. When a CPA reviews your company, there is no “pass or fail.” An auditor is simply an objective reference providing a report, for better or worse, that testifies to the state of your company’s security posture. “Failure” in SOC 2 generally comes in the form of a “qualified opinion,” meaning the auditor is telling the reader that your controls, or their execution, do not meet these particular criteria.

When a prospect or vendor inquires about your company’s security, they are asking for your attestation, not a certification. With this understanding in mind, your typical celebratory SOC 2 announcement headline should change.

from this: Llama Time, Inc. completes SOC 2 certification!

to this: Llama Time, Inc. successfully receives SOC 2 Type II attestation report.

To give a little more context, it also helps to understand what companies are actually attesting when it comes to SOC 2. Here’s a quick breakdown of the difference between SOC 2 Type I vs. SOC 2 Type II.

SOC 2 Type I attestation

SOC 2 Type I is a point-in-time, static snapshot that captures your business’s compliance frameworks as of a certain date or point in time. When an auditor is reviewing your business, they will investigate that snapshot to see whether or not the appropriate controls are present. Whether or not the controls are accurately present, an auditor will attest to, not certify. 

SOC 2 Type II attestation

SOC 2 Type II is a compliance review that takes place over a period of time, usually 6-12 months, in contrast to a point-in-time snapshot. The auditor will collect evidence and investigate the operating effectiveness of your business’s controls over the period. This is the reason why Type II is more intensive and expensive, but it’s also why it’s more meaningful. Just like Type I, an auditor will produce an objective report, not a certification, that is neither “pass nor fail.” 

Matt Cooper, Principal, Cybersecurity and Data Privacy

About the author: Matt leads the Privacy and Compliance team at Vanta. He has spent his 20+ year career in security and information technology. Prior to joining Vanta, Matt was the U.S. Director for the Cyber, Risk & Advisory practice at BSI where he led an information security consultancy providing risk management and readiness consulting for common industry frameworks such as ISO 27001, SOC2, HIPAA, and PCI. At Vanta, Matt works closely with audit partners, advises customers on security and compliance, and provides input to the product team.

Learn more about SOC 2 compliance 

Is all compliance regulatory compliance? 

What is a SOC 2 bridge letter?

Vanta’s SOC 2 compliance checklist