A SOC 2 report is how a service provider shows its clients that its controls work. It is an attestation by a CPA firm, not a certificate, and it is driven by client demand rather than law.
- Type
- Attestation report by a CPA firm
- Criteria
- AICPA Trust Services Criteria (2017, revised points of focus 2022)
- Issued in Canada under
- CSAE 3000 (SOC 1 uses CSAE 3416)
- Report types
- Type I (design) and Type II (operation over a period)
- Typical users
- SaaS, cloud, hosting, managed services, processors
- Regulator
- None; client and contract driven
What it is
An independent CPA firm examines the description of your system and the controls relevant to the Trust Services Criteria: Security (always included), and optionally Availability, Processing Integrity, Confidentiality and Privacy. A Type I report covers design at a point in time; a Type II covers design and operating effectiveness over a period, usually six to twelve months.
Why it exists
Your clients remain responsible for their data when they outsource to you. A SOC 2 report gives them independent evidence that your controls are designed and operating, without each client auditing you separately.
Who it applies to
Service organizations whose clients need assurance about security and related controls. SOC 1 is the separate report for controls relevant to clients’ financial reporting. SOC 3 is a short general-use summary.
Authority and enforcement
The AICPA owns the Trust Services Criteria and description criteria. In Canada, the Auditing and Assurance Standards Board sets the assurance standards: SOC 2 and SOC 3 reports are issued under CSAE 3000, applying the AICPA criteria; SOC 1 is issued under CSAE 3416. Only licensed public accounting firms can issue the report.
- 1990s–2010
The SAS 70 era of service auditor reports.
- 2010–2011
SSAE 16 (US), ISAE 3402 (international) and CSAE 3416 (Canada) replace it; the SOC 1, 2 and 3 names are introduced.
- 2017
Trust Services Criteria restructured on the COSO 2013 framework.
- 2018
Description criteria (DC 200) published.
- 2022-10
Revised points of focus and implementation guidance; the criteria themselves do not change.
Systems and tools
- Logical and physical access controls with MFA
- Monitoring, vulnerability management and backups
- Change management tooling
Processes
- Access reviews and onboarding or offboarding
- Incident response and recovery testing
- Evidence collection across the whole review period for Type II
Governance
- Risk assessment and control environment based on COSO
- Vendor and business-partner management
- A system description that matches reality
If you do not comply
- A qualified opinion or exceptions in the report
- Failed vendor due diligence and stalled sales cycles
- Breach of contract where a clean report is required
- Loss of client trust
Announced and upcoming changes
- None announcedNo revision of the 2017 Trust Services Criteria had been announced by the AICPA as of 2026-10-03.
Status checked 2026-10-03. Dates can move; confirm with the official sources below.
How we help
- AICPA & CIMA ↗
- AICPA description criteria (DC 200) ↗
- FRAS Canada guidance on SOC reporting (PDF) ↗
- FRAS Canada ↗
Related insights
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how…
Read the insight →Consumer-driven banking: the security bar for fintechs and payment providers
Canada's open banking regulations were proposed on 2026-06-27. Who must participate, the four accreditation pathways, the security and breach-reporting requirements, and how RPAA-registered PSPs…
Read the insight →CPCSC: Canada’s new cyber security certification for defence suppliers
The Canadian Program for Cyber Security Certification started with Level 1 in 2026, and Level 2 certification phases into defence contracts from April 2027.…
Read the insight →