The AICPA
Defines the criteria
The American Institute of CPAs (certified public accountants) owns SOC 2 and writes the Trust Services Criteria the examination is measured against. It does not audit anyone.
SOC 2 · AICPA attestation report
SOC 2 asks you to prove your controls worked for months. Quox is the record for the ones your agents touch.
SOC 2 is a report from an independent CPA firm, not a certificate. Quox is not SOC 2 attested: it is the evidence layer that fills the audit period.
What it isa CPA attestation reportType II period3 to 12 monthsCriteria5 · Security mandatoryQuox statusnot attested, evidence layerStart here
It is an opinion on your controls, not a certificate
If a customer’s security team has just asked for your SOC 2 report, this is the idea that matters most. Three parties are involved, and only one of them is you.
A licensed CPA firm
Examines and gives the opinion
An independent firm tests your controls and signs the report. The opinion is theirs, not yours and not a tool’s.
Your organisation
Runs the controls and asserts they work
Management writes the system description and the assertion, and runs the controls the auditor then samples. This is the part you own.
A note on the phrase. You will hear “SOC 2 certified” everywhere, including from vendors. It is a common misnomer: there is no certificate and no certifying body. The accurate words are SOC 2 report, attestation or examination, and this page uses them.
The audit period
Type I is a point. Type II is the whole stretch of time
The difference that matters most. A Type I report says your controls looked right on one day. A Type II report says they worked across months, and that is the one enterprise buyers ask for.
Type I
Are the controls suitably designed, as of one date? The auditor looks at the design and the paperwork on that day. It says nothing about whether they kept working.
Type II
Did the controls operate effectively over a period, typically 3 to 12 months? Three months is a common minimum. Six to twelve is what most enterprises expect to see.
The evidence
The auditor samples across the whole period. Evidence has to exist for the days in between, not be rebuilt from memory at the end. That is the part a record can do and a binder cannot.
Scope
Five criteria, one of them mandatory. Choose your scope
Security is in every SOC 2. The other four are optional and chosen by what your customers need to hear. Try it: switch the optional ones on and see what your report would cover, and how much of each is Quox.
Your report would coverSecuritySecurity only. A common first report.
Security
Also called the Common CriteriaIs the system protected against unauthorised access and misuse?
Where Quox fitsAccess, change, monitoring and operations controls (CC4 to CC8) are where the witnessed record, scoped tokens and approvals do real work.
Strongest fitAvailability
OptionalIs the system up and usable as you committed?
Where Quox fitsUptime of your service is your infrastructure’s job. An E-STOP and an operational record help you show how agents behaved during an incident.
Mostly yoursProcessing integrity
OptionalDoes processing happen completely, accurately and when authorised?
Where Quox fitsA record of what governed agents did, and approval before risky steps. Whether your processing is accurate stays your engineering work.
PartialConfidentiality
OptionalIs information designated confidential protected?
Where Quox fitsPolicies can stop sensitive data reaching an external model, and the block is recorded. Classification and encryption choices are yours.
PartialPrivacy
OptionalIs personal information collected, used, kept and disposed of as promised?
Where Quox fitsYour notices, consent and retention decisions are yours. Quox can show what governed agents did with data and that a block fired.
Mostly yoursThe Common Criteria
CC1 to CC9, in plain words, and how much is Quox
These nine categories make up Security. CC1 to CC5 follow the COSO internal-control framework’s 17 principles. An honest read of the whole set: most of it is plainly your job.
CC1Yours
Control environment
The tone from the top: ethics, board oversight, who is accountable, and whether you hire and train for it.
CC2Yours
Communication and information
Whether the right information reaches the right people, inside the company and out to customers.
CC3Yours
Risk assessment
Do you identify and weigh the risks to your commitments, including fraud and changes in the business?
CC4Partly Quox
Monitoring activities
Do you check that your controls are working, and act on what you find?
Where Quox fitsA tamper-evident record to monitor from: actions taken, blocked and sent to a human. Deciding what to monitor and what to do about it stays yours.
CC5Strongest fit
Control activities
The actual controls: the policies and procedures that turn risk decisions into things that happen.
Where Quox fitsThe policy gate acts before a governed action runs, and human approval sits on the risky steps. Each leaves a receipt that it fired.
CC6Strongest fit
Logical and physical access controls
Who can reach your systems and data, how they prove who they are, and how access is removed.
Where Quox fitsScoped capability tokens instead of broad credentials, an identity on every governed action, and governed SSH through Bastion. Physical access and staff offboarding are yours.
CC7Strongest fit
System operations
Detecting problems, responding to incidents and recovering. The day-to-day of running the system.
Where Quox fitsThe witnessed operational record, E-STOP to halt agents, and a DEFCON posture that steps the instance down. Your incident process around it is yours.
CC8Partly Quox
Change management
How changes to systems and software are authorised, tested and approved before they go live.
Where Quox fitsGovernance policy changes keep an append-only history, and audit-required changes need a second person. Your code release process stays yours.
CC9Yours
Risk mitigation
Business-continuity thinking and managing the risk that comes with vendors and business partners.
What is in the report
Four parts, and who writes each
A SOC 2 report is a document you hand to customers. Knowing who writes which part shows you what is yours to prepare.
- The CPA firm
The auditor’s opinion
The CPA firm’s conclusion: unqualified, qualified, adverse or disclaimer. Unqualified is the clean one a customer wants to see.
- Your management
Management’s assertion
Your written statement that the system description is fair and the controls were designed and operated as described.
- Your organisation
The system description
What the service is, its boundaries, the people, software, data and procedures involved, and the controls you say are in place.
- The CPA firm, from your evidence
Tests of controls and results
Each control the auditor tested, how they tested it, and what they found. For Type II this covers the whole period, by sampling.
The opinion is one of four kinds: unqualified, qualified, adverse or disclaimer. Part four, for a Type II, is where the period shows up: the auditor tests whether each control operated across it.
The honest map
The auditor samples the period. Quox is what they sample from
Most teams scramble to rebuild a year of evidence in the weeks before the audit. A witnessed record made as the agents work is already timestamped and in order, so the observation period is documented before anyone asks.
Reconstructed at audit time
- Screenshots and exports gathered after the fact
- Gaps in the months nobody was looking
- Evidence you cannot show was not edited
Made as the work happens
- Every governed action recorded when it ran
- A hash chain, so an edit shows
- Verifiable offline by the auditor, without taking your word
CC4
Show me how you knew your controls were working in month four.
MonitoringBlocks, denials and approvals sit in the same hash-chained record as the actions. Open it at any date in the period.
CC5
Pick a risky action. Was the control in front of it, and did it fire?
Control activitiesA policy gate decision with a receipt, and a human approval where the policy required one. A governed agent cannot approve its own real gate.
CC6
Who did this, with what authority?
AccessAn identity attached to every governed action, under a scoped capability token rather than a shared credential.
CC7
Walk me through that incident last quarter.
OperationsA replayable trace of the governed run, in order and timestamped, plus the E-STOP and posture changes if one was used.
CC8
Did the rules change during the period, and who agreed?
ChangeAn append-only policy history. Audit-required policy changes need a second person.
Keep it past the period
The evidence has to be there while the auditor finishes, and the next period will be compared with this one. SOC 2 sets no retention number, so you decide from your own policy, contracts and sector. Our guide walks through how to choose.
A SaaS vendor’s own SOC 2 report covers the vendor’s system, not your agents. Quox is self-hosted, so the record of what your agents did lives on your servers, which is where you will be asked for it.
The auditor page shows what the other side of the table can verify without a Quox account, and the compliance suite covers report exports. Working on AI management? See the ISO 42001 page and the NIST AI RMF page, which fit alongside this one. The SOC 2 to AI compliance post takes the wider view.
Honest maturity
What ships today, what does not, and what is yours
Quox is one layer. The examination itself is a human engagement with a CPA firm. Here is the line, drawn plainly.
Ships today
- Witnessed, hash-chained, tamper-evident record of every governed agent action (WARD and VOLT, the evidence protocols), timestamped and ordered as the work happens.
- Policy gate enforced at execution, with two-person approval for audit-required policy changes and an append-only history, a change trail an auditor can sample.
- Human-in-the-loop approval inbox, so a governed agent cannot self-approve a real gate.
- Scoped capability tokens, governed SSH through Bastion, E-STOP and a DEFCON posture.
- Replayable traces of every governed run, and exportable evidence bundles an auditor verifies offline with no Quox account.
- SOC 2 listed among the compliance suite’s framework report exports, built from your records.
Not shipped
- A policy simulator, so you can test a policy before it goes live. Planned, not shipped.
- A published control-level crosswalk to every criterion and point of focus. Not published; this page maps at the level of CC4 to CC8.
Still your job
- The CPA engagement itself: choosing the firm, scoping the examination, the fieldwork and closing exceptions. Quox does not do this and cannot.
- The system description and management’s assertion.
- Most controls: hiring, training, vendor management, physical security, business continuity and your own release process.
- Choosing which optional criteria are in scope, and the length of the period.
- Deciding what to keep, and for how long, past the period for this report and the next.
The path
Your first SOC 2, in six moves
Timelines vary with size and how much you already run. The order is the useful part.
Pick your scope
Security is in every SOC 2. Then choose which of the other four your customers actually ask about. Fewer criteria means a smaller, cheaper first report.
Run a readiness check
Compare what you do today with the criteria, and list the gaps. A gap found now is a note. A gap found in fieldwork is an exception in the report.
Close the gaps and write it down
Put the policies, access controls and change process in place, and draft the system description. Plain and accurate beats long.
Optionally take a Type I
A point-in-time report on design. Some teams use it as a first step, and it unblocks a customer who needs something now. It is not what most enterprises finally want.
Run the period and collect evidence
This is the long step. Controls run for the months of the period and evidence is made as you go, so it exists on every day the auditor might sample.
The examination, then renewal
The CPA firm tests, samples and issues the report. Reports are typically renewed each year, which means the next period starts as soon as this one ends.
Questions people actually ask
SOC 2: the FAQ
What is SOC 2?
SOC 2 stands for System and Organization Controls 2. It is an attestation report in which an independent licensed CPA firm examines a service organisation’s controls against the AICPA’s Trust Services Criteria and gives an opinion. Customers ask for it before they trust you with their data.
Is SOC 2 a certification?
No, though vendors often say “SOC 2 certified”. It is an attestation: a CPA firm’s opinion on your controls, issued as a report. There is no certificate and no certifying body. “SOC 2 report”, “SOC 2 attestation” or “SOC 2 examination” are the accurate phrases.
What is the difference between SOC 2 Type I and Type II?
Type I reports on the suitability of the design of your controls at a single point in time. Type II reports on whether those controls operated effectively over a period, typically 3 to 12 months. Type II is the one most enterprise buyers ask for, because it shows the controls kept working.
How long is a SOC 2 Type II audit period?
Typically 3 to 12 months. Three months is a common minimum, and six to twelve months is what most enterprises expect. The auditor samples evidence from across the whole period, so the evidence has to exist continuously rather than as an end-of-period snapshot.
What are the five Trust Services Criteria?
Security, Availability, Processing Integrity, Confidentiality and Privacy. Security, also called the Common Criteria, is the only mandatory one and appears in every SOC 2. The other four are optional and chosen by scope.
What are CC1 to CC9?
The nine Common Criteria categories under Security: CC1 Control Environment, CC2 Communication and Information, CC3 Risk Assessment, CC4 Monitoring Activities, CC5 Control Activities, CC6 Logical and Physical Access Controls, CC7 System Operations, CC8 Change Management and CC9 Risk Mitigation. CC1 to CC5 map to the COSO internal-control framework’s 17 principles.
Is Quox SOC 2 attested, and does it make me compliant?
No to both. Quox holds no SOC 2 report, and no tool can give you one: only a CPA firm can. Quox is the evidence layer that makes the Type II period auditable, with a witnessed record produced as your agents work, pre-action policy gates, human approval and evidence an auditor verifies offline.
How does this relate to ISO 27001 and the NIST AI RMF?
SOC 2 is a CPA attestation report on your controls and cannot be certified. ISO 27001 is a certifiable information security management system. The NIST AI RMF is a voluntary AI framework with no certificate. Many teams hold one and use another as an input. For AI specifically, ISO 42001 is the certifiable AI management system. Read the NIST AI RMF page.
How long should I keep AI agent logs for a SOC 2 audit?
SOC 2 does not set a number. Keep the evidence for the whole observation period and long enough for the auditor to finish and for the next period to be compared. Your own policy, contracts and sector decide the rest. Our guide to AI agent log retention walks through how to choose. How long to keep AI agent logs.
Sources
Related frameworks
Self-hosted · free · governed
Start the audit period with the record already running
A SOC 2 Type II period runs for months, and the evidence has to cover all of them. Record continuously from day one, not in a scramble at the end of the period.