What is a SOC 2 report?
DigitalXForce wrote this page.
A SOC 2 report sets out a CPA firm’s examination of a service organization’s description of its system and of its controls relevant to security, availability, processing integrity, confidentiality or privacy, under AICPA attestation standards. DigitalXForce tests those controls against live evidence and keeps the records for the auditor, and the opinion in the report belongs to the CPA firm.
The value of a SOC 2 report is the auditor’s independence. AICPA has warned that promises of “fast and easy” reports threaten the credibility of SOC engagements. A platform can make the evidence complete and current, and the opinion has to stay where it belongs.
What a SOC 2 examination covers
The examination
SOC, System and Organization Controls, is a suite of services that CPAs provide on the controls of service organizations and other entities. A SOC 2 is an assertion-based examination under AT-C section 205. Management describes the service organization’s system and gives a written assertion about it, and the service auditor examines the description and the controls and reports on them. A SOC 3 report covers the same ground in a general-use form.
The criteria
The auditor evaluates the controls against the 2017 Trust Services Criteria, with revised points of focus from 2022, which AICPA’s Assurance Services Executive Committee sets. AICPA calls them “outcome-based criteria” for judging whether a system and its controls achieve the objectives management has set. The description of the system is evaluated against the 2018 description criteria, DC 200, with revised implementation guidance from 2022. A report covers one or more of the 5 categories: security, availability, processing integrity, confidentiality and privacy.
Type 1 and Type 2
AICPA publishes separate illustrative management representation letters for Type 1 and Type 2 examinations. Its illustrative Type 2 report contains management’s assertion, the description of the system, the service auditor’s report, and the auditor’s tests of controls with their results. Those tests are what a customer reads to see how the controls performed.
What a report reader checks
AICPA’s training for report users points them to the opinion type, to the complementary user entity controls and complementary subservice organization controls, and to whether subservice organizations are included in the report or carved out. Complementary user entity controls are the controls the service organization relies on its customers to operate, so they belong in each customer’s own control set.
How can SOC 2 controls be continuously validated?
SOC 2 controls are continuously validated by testing each control against live evidence on its own schedule through the whole report period, so the service organization knows how each control performed before the auditor tests it.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA. For SOC 2, CCM watches the evidence behind each control, and CCA decides whether the control still works.
A Type 2 report is where this shows. AICPA’s illustrative Type 2 report contains the auditor’s tests of controls with their results, which is what a customer reads to see how the controls performed. The earlier a failure is found and fixed, the shorter the time the control was not operating during the period.
The table shows example controls, how DigitalXForce reads the evidence for each and how often. The frequencies come from DigitalXForce’s example evidence plan, and each organization sets its own, since each control is tested on a schedule set by how quickly its evidence can change.
| SOC 2 category | What is tested | How DigitalXForce reads the evidence | How often, in the example plan |
|---|---|---|---|
| Security | Multi-factor authentication is enforced. | The platform reads MFA status from the identity tool that enforces it. | It is read daily. |
| Security | Privileged accounts are known and limited. | The platform reads the privileged account inventory from the identity tools. | It is read daily. |
| Security | Access rights are reviewed. | The platform reads the access review logs from the identity tools. | They are read weekly. |
| Security | Systems are configured to the organization’s standard. | ESRPM runs configuration checks across network security, cloud and identity tools. | Configuration hygiene is read continuously. |
| Security | Software is patched, and critical vulnerabilities are fixed. | Patch currency and critical CVE status come from scanners such as Qualys and Tenable. | They are read daily. |
| Security | Logs are kept and reach the SIEM. | The platform checks log retention and the health of the SIEM feed. | They are read hourly. |
| Availability | Backups are made and verified. | The platform reads the backup verification results. | They are read daily. |
| Confidentiality | Data is encrypted. | The platform reads encryption status from the systems that enforce it. | It is read continuously. |
A test result is not an opinion. The CPA firm plans its own tests, decides the sample and gives the opinion, and management writes the system description and its assertion.
What DigitalXForce does for SOC 2
DigitalXForce helps on both sides of a SOC 2 report: the service organization that is examined and the customer that reads the report.
For a service organization, DigitalXForce reads evidence through 250+ technology integrations across cloud, identity, endpoint, SIEM, vulnerability management, ITSM and enterprise applications. Each piece of evidence tests a control from a normalized control library, and each control is mapped once to every requirement it satisfies across 50+ compliance frameworks, SOC 2 among them. The same test result answers SOC 2, ISO/IEC 27001 and PCI DSS.
Each control is tested on its own schedule. In DigitalXForce’s example evidence plan, MFA status is read daily, encryption status and configuration hygiene continuously, backup verification daily and log retention and SIEM feed health hourly. Every result is stored with the evidence it read and a timestamp, and the compliance dashboards show evidence age, so the auditor sees each control’s history instead of a sample assembled for the audit.
A failed test becomes a finding with an owner and a due date in the team’s own tools, such as ServiceNow or Jira, and the control is tested again when the fix is marked done. An accepted exception is recorded as a named person’s decision with a reason and an expiry date. The policy library links each policy to the controls it governs, and controls with no machine-readable evidence run through the C-Assess, X-Assess and A-Assess assessments with a reviewer’s approval.
For a customer, the third-party risk management module reads the reports that vendors send. AI JedAI reads each SOC 2 report, maps it to the customer’s controls and flags the gaps, and an analyst reviews and approves the result before it counts. External Risk View watches the vendor from outside between reports, and a material change in the vendor’s posture triggers a reassessment instead of waiting for next year’s report.
DigitalXForce tests SOC 2 controls continuously against live evidence, so the evidence for the next SOC 2 Type 2 audit is collected as each control is tested rather than gathered at the end of the period. DigitalXForce keeps a current SOC 2 Type 2 report of its own, renewed every year and last issued in October 2026.
What stays with the service organization, the customer and the auditor
A SOC 2 report has three parties, and DigitalXForce is none of them.
- The service organization chooses an independent CPA firm and the categories in scope, and it writes the system description and management’s assertion.
- The service auditor plans and performs the tests, decides the sample and gives the opinion.
- The customer operates the complementary user entity controls that each vendor’s report lists, and it decides what to do about the exceptions in the report.
How SOC 2 maps to the platform
| SOC 2 element | What DigitalXForce does | What the organization or the auditor still does |
|---|---|---|
| Security | Identity, endpoint, vulnerability, logging and configuration evidence is read from the tools that enforce each control. | The service organization designs and operates the controls. |
| Availability | Backup verification is read daily in the example plan, and X-BCOR ties continuity plans to live control coverage. | The service organization sets its availability commitments. |
| Processing integrity | Controls inside applications with no machine-readable evidence run through assessments with a reviewer’s approval. | Application owners design and operate the processing controls. |
| Confidentiality | Encryption status and access review logs are read from the systems that enforce them. | The service organization classifies its confidential information. |
| Privacy | Privacy controls map once to privacy frameworks such as GDPR and CCPA in the same library. | The service organization sets its privacy commitments and notices. |
| Description of the system | Attack Surface Manager and the 250+ technology integrations show the systems that run the service. | Management writes the description and the assertion. |
| Auditor’s tests | Every control result is kept with its evidence and timestamp for the auditor to test. | The CPA firm tests the controls and gives the opinion. |
| Vendors’ reports and complementary user entity controls | AI JedAI maps each vendor’s SOC 2 report to the customer’s controls and flags gaps for an analyst to approve. | The customer operates the complementary controls and acts on the vendor’s exceptions. |
Where DigitalXForce is not the answer
DigitalXForce is not a CPA firm, and it does not issue SOC 2 reports or opinions. A startup or small company preparing its first SOC 2 with a handful of cloud tools can start with DigitalXForce Lite, which is the same platform hosted in the cloud, with the same functionality as the full platform, a faster deployment and a lower price point. The full platform fits a service organization that holds SOC 2 beside other frameworks across many tools, and a customer that reads dozens of vendor reports a year.
What is tested from live data and what still needs a person
Which controls DigitalXForce tests directly from live tool data depends on the tools you connect through X-Connect and E-Connect. Controls that rest on a document, such as a signed policy, are reviewed by AI JedAI against the requirement and kept with their evidence. The demo shows that split for your own stack.
You can read more about SOC 2 and ISO 27001 evidence collection.
The evidence the auditor receives
For each control, the auditor receives the test result, the evidence it read, the time it was read and the history of earlier results. A-Assess prepares the evidence and findings in the form auditors review.
Other frameworks the same controls report to
Many SOC 2 controls, such as access reviews, change management and incident response, also answer requirements in ISO/IEC 27001, NIST CSF 2.0, HIPAA and PCI DSS. DigitalXForce maps such a control once, so one test result reports to each framework it belongs to. The article on the common control framework explains the method.
SOC 2 reports are asked for in every sector DigitalXForce serves, and the industries page shows how each one uses the platform.
DigitalXForce is not a certification, assessment or authorization body for SOC 2. It tests and documents the controls the framework requires.
Questions about SOC 2
How can SOC 2 controls be continuously validated?
Test each control against live evidence on its own schedule through the report period, and fix each failure as it is found. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. The CPA firm still performs its own tests and gives the opinion.
How can SOC 2 evidence collection be automated?
Connect the identity, endpoint, vulnerability, logging and configuration tools that enforce each control and read the evidence from them. DigitalXForce reads evidence through 250+ technology integrations and keeps every result with its evidence and a timestamp for the auditor. Controls inside applications with no machine-readable evidence run through assessments with a reviewer’s approval.
Who can issue a SOC 2 report?
A CPA firm, acting as the service auditor, issues the report under AICPA’s attestation standards, which treat a SOC 2 as an assertion-based examination under AT-C section 205. AICPA members in public practice in the United States must work in firms enrolled in an approved practice-monitoring program.
What does a SOC 2 report cover?
It covers a service organization’s description of its system and its controls relevant to one or more of security, availability, processing integrity, confidentiality and privacy. The controls are evaluated against the 2017 Trust Services Criteria with revised points of focus from 2022, and the description against the 2018 description criteria.
What is in a SOC 2 Type 2 report?
AICPA’s illustrative Type 2 report contains management’s assertion, the description of the system, the service auditor’s report, and the auditor’s tests of controls with their results. The tests and results show a reader how the controls performed.
What should a customer check in a vendor’s SOC 2 report?
AICPA’s training for report users highlights the opinion type, the complementary user entity controls and the complementary subservice organization controls. The complementary user entity controls are the vendor’s expectations of its customers, so each one belongs in the customer’s own control set.
Does DigitalXForce issue SOC 2 reports?
It does not. SOC 2 reports come from independent CPA firms. DigitalXForce tests the controls, keeps timestamped evidence of every result for the auditor, and reads the SOC 2 reports that vendors send.
DigitalXForce terms used on this page
DigitalXForce gives each of its terms one definition and uses it everywhere, including in its glossary.
- Enterprise Security Risk and Posture Management (ESRPM) is the DigitalXForce module that runs configuration checks, operational insights and deployment benchmarking across IAM, SIEM, cloud, OT and IoT, SecOps and enterprise systems through 250+ technology integrations.
- AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements.
Related pages
- What Is Continuous Control Assurance (CCA)? explains the strategic level of control assurance, which validates whether controls continue to operate as expected.
- What Is Continuous Control Monitoring (CCM)? explains the capability within Continuous Control Assurance that monitors the evidence behind each control between tests.
- The Automated GRC module maps each control once across 50+ compliance frameworks.
- Third-party risk management reads the SOC 2 reports that vendors send.
- The policy and compliance management module covers the policies a SOC 2 examination reads.
- What is a common control framework? explains how one control, written and tested once, serves every framework it maps to.
- How automated control testing decides whether a control still works explains the test behind each result.
- How to continuously maintain audit readiness covers keeping the evidence for every in-scope control current between audits.
- Is automated evidence trustworthy? covers provenance, freshness and what happens when an integration fails.
- The PCI DSS page covers the standard for entities that store, process or transmit cardholder data.
- The frameworks page lists the most requested frameworks.
Sources
- AICPA’s page “System and Organization Controls: SOC Suite of Services” describes the SOC suite and links the warnings on “fast and easy” reports and on arrangements with SOC 2 tool providers, at https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services.
- AICPA’s page for the guide “SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy” describes the assertion-based examination, SOC 3, the 2017 Trust Services Criteria with revised points of focus from 2022 and the 2018 description criteria, at https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy.
- AICPA’s page for the 2017 Trust Services Criteria (with revised points of focus, 2022) names the Assurance Services Executive Committee, at https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022.
- AICPA’s page on mappings to the Trust Services Criteria calls them outcome-based criteria, at https://www.aicpa-cima.com/resources/article/get-mappings-relevant-to-the-soc-suite-of-services.
- AICPA’s illustrative SOC 2 Type 2 report page lists what the report contains, at https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion.
- AICPA’s illustrative management representation letters for Type 1 and Type 2 examinations cite AT-C section 205, at https://www.aicpa-cima.com/resources/download/illustrative-management-representation-letter-soc-2-r-type-1 and https://www.aicpa-cima.com/resources/download/illustrative-management-representation-letter-soc-2-type-2.
- AICPA’s webcast page “SOC 2 Report Walkthrough” lists what report users should identify, at https://www.aicpa-cima.com/cpe-learning/webcast/soc-2-report-walkthrough.
- AICPA’s page on common peer review deficiencies in SOC 1 and SOC 2 engagements states the practice-monitoring rule, at https://www.aicpa-cima.com/resources/download/see-common-peer-review-deficiencies-from-soc-1-r-and-soc-2-r-engagements.
- Every source above was read on 25 September 2026.
Do this once instead of every audit.
Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
