I85PREP
⌘ K
Certified Lead SOC 2 Analyst study materials
Certified Lead SOC 2 Analyst study resources

Certified Lead SOC 2 Analyst: SOC 2 Fundamentals and Trust Services Criteria

Certified Lead SOC 2 Analyst · Work through your exam, one topic at a time.

All guide sections

SOC 2 Fundamentals and Trust Services Criteria

Domain 1 - SOC 2 fundamentals and trust services criteria. The exam tests whether you can distinguish a SOC 2 examination from a certification, name the five trust services categories, map the Common Criteria, and read a report's structure and opinion.

What a SOC 2 report is

  • It is an attestation examination performed by a CPA firm under AICPA AT-C 105 and AT-C 205, not a certification, and not a pass/fail compliance stamp.
  • Every report contains management's assertion, the system description, and the practitioner's opinion. A Type 2 report adds a description of the tests performed and their results.

The five categories

  • Security is mandatory and is expressed through the Common Criteria CC1–CC9: control environment, communication and information, risk assessment, monitoring activities, control activities, logical and physical access, system operations, change management, and risk mitigation.
  • Availability, Processing Integrity, Confidentiality, and Privacy are optional and must be justified by commitments. Privacy criteria derive from the AICPA's GAPP and apply only when personal information is in the system.
  • Points of focus illustrate how a criterion might be met; they are not additional requirements.

Type 1 vs Type 2

A Type 1 report opines on fairness of the description and suitability of design as of a date. A Type 2 report adds operating effectiveness over a period, commonly 3–12 months.

Worked example

A vendor states, 'We are SOC 2 Type 1 certified, so our security is proven.' Reasoning: certification is the wrong term; a Type 1 does not test operating effectiveness; the scope may cover Security only. Ask for the system description's boundaries, the categories in scope, the CUECs, and a Type 2 period covering your reliance window, plus a bridge letter if the report period has ended.

Traps

Treating Security as optional; expecting an overall pass score; assuming the report is public; quoting points of focus as criteria; equating the Privacy category with GDPR compliance.