SOC 2
AICPA attestation report on a service organization's controls over Security, Availability, Processing Integrity, Confidentiality, and Privacy, the standard SaaS trust artifact.
Definition
SOC 2 (Service Organization Control 2) is an attestation report issued by an independent CPA firm under the AICPA SSAE 18 standard, evaluating a service organization's controls against one or more of the five Trust Services Criteria: Security (always required), Availability, Processing Integrity, Confidentiality, and Privacy. A SOC 2 Type I report attests to control design at a point in time; a Type II report attests to operating effectiveness over a period (typically 6-12 months) and is the much stronger artifact. SOC 2 is the de facto baseline trust report for SaaS, cloud, and processing-on-behalf-of-customer services in the U.S.What this means in practice
Customers may request a scoped SOC 2 report as supplier-assurance evidence. Whether Type II is required or substitutes for a questionnaire depends on the contract and buyer. It does not establish HIPAA compliance or replace a HIPAA-specific risk analysis.Examples
- Illustrative: A MedTech startup developing a cloud-based platform for remote patient monitoring obtains a SOC 2 Type II report to demonstrate to hospitals and clinics that their data security and privacy controls are robust and operational.
- Illustrative: Before integrating a new third-party AI service for medical image analysis, a diagnostic device manufacturer requests their vendor's SOC 2 Type II report to verify adequate protection for sensitive patient data.
- Illustrative: A clinical research organization requests a SOC 2 Type II report covering the relevant SaaS systems, then separately evaluates its regulatory and contractual obligations.
- •Treating SOC 2 Type I as equivalent to Type II, Type I is design-only and provides little operational assurance.
- •Scoping SOC 2 to a subset of the product to make the audit easier, customers will check the scope statement and reject reports that exclude the systems they care about.
- •Confusing SOC 2 with HIPAA, SOC 2 includes some HIPAA-relevant controls but a SOC 2 report doesn't substitute for a Security Risk Analysis under 45 CFR 164.308.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsU.S. government-wide program that standardizes security assessment, authorization, and continuous monitoring for cloud services sold to federal agencies.
Voluntary HHS healthcare cybersecurity practices that can support recognized-security-practices evidence in HIPAA enforcement.
U.S. federal law governing the privacy and security of protected health information.
Healthcare-focused certifiable security framework that consolidates HIPAA, NIST, ISO 27001, and other authorities into a unified control set.
More in Cybersecurity
· Same categoryInternational standard for information security management systems (ISMS), often required of MedTech vendors by enterprise customers.
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
4 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
Official-source claim check:
SOC 2 is an independent controls examination report, not a product certification or HIPAA compliance guarantee.
Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.
Remaining verification limits
- Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.
- 1AICPA SOC 2 ExaminationsTier 2 VerifiedAICPAaicpa-cima.com
- 2Trust Services CriteriaTier 2 VerifiedAICPAaicpa-cima.com
- 3FDA - Cybersecurity for Medical DevicesTier 2 VerifiedFDAfda.gov
- 4AICPA SOC 2Tier 2 UncheckedAICPAaicpa-cima.com
Inline markers like [1] jump to the matching reference above.