SOC 2 Type II and SOP Software: What the Claim Tells You

SOC 2 is a reporting framework from the AICPA for service organizations. A CPA firm examines the provider's controls against trust services criteria such as security, availability and confidentiality. A Type I report looks at the design of the controls at one point in time. A Type II report also tests whether they operated effectively over a period, often several months to a year. The report itself is usually shared with customers under a non-disclosure agreement rather than published.

Not found means we did not see it on the pages listed in the sources. The vendor may hold a report; ask.

• Whether the tool has an approval step, and who can approve.
• How long version history is kept on your plan.
• Whether electronic signatures meet 21 CFR Part 11 for FDA-regulated records. That is a separate question.
• Whether the controls you rely on, such as single sign-on, SCIM or audit logs, are on the plan you buy.

• The latest SOC 2 Type II report and the period it covers.
• Any exceptions the auditor noted, and the vendor's response.
• Which of the vendor's own providers, such as its cloud host, are covered by their own reports.
• A bridge letter if the report period ended several months ago.
• Which plan includes single sign-on, SCIM and audit logs.

It is one input to our audit trail and compliance criterion, weighted 15%, alongside the audit trail itself and support for regulated records. A SOC 2 statement alone does not earn a high score. Haiku, Scribe and Tango, which state SOC 2 Type II, score 6 on that criterion; Process Street, with SOC 2 Type 2 and HIPAA on every plan and recorded approvals, scores 9; Qualio, with immutable audit trails and Part 11 e-signatures, scores 10.