What SOC 2 actually means for your vendor review

SOC 2 shows up on nearly every vendor security questionnaire, but the certification itself is often misunderstood. It is not a single pass/fail test — it is an audit report, and what it actually covers depends on which "trust service criteria" the vendor chose to be assessed against.

Type I vs Type II

A Type I report assesses whether controls are designed appropriately at a single point in time. A Type II report — the one you should actually ask for — assesses whether those controls operated effectively over a period, typically 6-12 months. Type II is a materially stronger signal.

The five trust service criteria

Security is mandatory in every SOC 2 report. Availability, processing integrity, confidentiality, and privacy are optional — a vendor can be SOC 2 certified while only being assessed against security. If data privacy matters for your use case, confirm privacy was actually in scope.

What to actually ask for

Request the full report, not just the certificate. The certificate confirms an audit happened; the report tells you which controls were tested, whether any exceptions were noted, and how the vendor remediated them. A report with no exceptions noted across a full 12-month Type II period is a strong signal.