# SOC 2

Concept · [Cloud, hosting and security](https://ecosystem.samcarlton.com/cloud)

Also called: SOC2, SOC 2 report, SOC 2 compliance, SOC 2 Type 1, SOC 2 Type 2, SOC II, sock 2, security audit

An examination of how a service company protects [customer data](https://ecosystem.samcarlton.com/data-privacy). The AICPA, the US accounting profession's standards body, defines it, and an independent accountant carries it out. The result is a report that a customer may ask to see before buying.

**For example:** A hospital asks a startup for its SOC 2 report during a [sales process](https://ecosystem.samcarlton.com/sales-cycle). The startup hires an independent audit firm to perform the examination.

## Connects to (14)

- [Compliance](https://ecosystem.samcarlton.com/compliance): Meeting the laws, regulations and standards that apply to a company.
- [Data privacy](https://ecosystem.samcarlton.com/data-privacy): How a company collects, uses, stores and shares information about people.
- [Encryption](https://ecosystem.samcarlton.com/encryption): Scrambling data with a key so only someone with the right key can read it.
- [Due diligence](https://ecosystem.samcarlton.com/due-diligence): The checking an investor or buyer does before committing money: reviewing your finances, legal documents, product and the claims you have…
- [B2B / B2C](https://ecosystem.samcarlton.com/b2b-b2c): Who you sell to.
- [SSO](https://ecosystem.samcarlton.com/sso): Single sign-on.
- [Multi-factor authentication](https://ecosystem.samcarlton.com/mfa): A sign-in that asks for more than one kind of proof, drawn from something a person knows, something a person has and something a person is.
- [ISSA Oklahoma](https://ecosystem.samcarlton.com/issa-oklahoma): The Oklahoma chapter of the Information Systems Security Association, a professional group for cybersecurity workers.
- [Cyber liability insurance](https://ecosystem.samcarlton.com/cyber-liability-insurance): Insurance that helps pay the costs of a data breach or cyberattack, such as investigation, customer notification, legal costs and recovery.
- [Zero-day vulnerability](https://ecosystem.samcarlton.com/zero-day-vulnerability): A security flaw that attackers know about before the software's maker has a fix, so defenders have had zero days to patch it.
- [ISO/IEC 27001](https://ecosystem.samcarlton.com/iso-27001): An international standard for running an information security management system.
- [FutureCon](https://ecosystem.samcarlton.com/futurecon): A series of one-day cybersecurity conferences in cities across North America, run by FutureCon Events, with talks, a panel and sponsor…
- [Fractional CISO](https://ecosystem.samcarlton.com/fractional-ciso): A part-time security leader.
- [Palo Alto Networks](https://ecosystem.samcarlton.com/palo-alto-networks): A cybersecurity company that sells firewalls and security software to businesses, schools and governments.

> This glossary is plain-language orientation, not legal or financial advice. Before you decide on a company structure, a contract, taxes or a fundraising deal, talk with a lawyer or an accountant.

Map view: https://ecosystem.samcarlton.com/soc-2