SOC 2 Certified? Why That's the Wrong Question

Security questionnaires ask it every day, and vendors answer "yes" every day. But there is no such thing as SOC 2 certification, and the shorthand hides what buyers actually need to know.

Every security questionnaire seems to include it: "Are you SOC 2 certified?" And vendors answer "yes", attach a PDF, and the box is ticked. The trouble is that the question doesn't mean what either side thinks it means, and a ticked box can hide exactly the risks the buyer was trying to find.

There is no SOC 2 certificate

SOC 2 is an attestation, not a certification. A licensed CPA firm examines a service organisation's controls against the AICPA's Trust Services Criteria and issues a report with its opinion. Nobody issues a certificate, nobody keeps a register of certified companies, and there is no pass mark. Compare ISO 27001, where an accredited certification body does issue a certificate, with a defined scope, valid for three years. (Our ISO 27001 vs SOC 2 comparison sets out the differences.)

Calling a SOC 2 report a certificate isn't just pedantry. It turns a detailed, conditional document into a yes-or-no badge, and the details are where the risk is.

What "yes" can hide

A vendor can truthfully say it has a SOC 2 report while:

The report is a Type I. It shows that controls were designed and in place on one day, not that they worked over time.
The scope excludes the service you are buying. A report covers a described system. If your data flows through a product or region outside it, the report says nothing about it.
The period ended long ago. A report covers a past period. A gap of many months since its end means nobody has tested recent operation.
The opinion is qualified, or the test results list exceptions that matter to you.
Key controls are carved out to a subservice organisation, such as the cloud host, whose own report you never see.
The report relies on controls you must run yourself, listed as complementary user entity controls, and nobody on your side knows about them.
Only Security is in scope, when what you cared about was availability, confidentiality or privacy.

None of these makes a report worthless. All of them are invisible behind "yes".

Photograph of a thick bound report open on a desk with sticky tabs near the back, reading glasses and a coffee cup beside it — The useful parts of a SOC 2 report are rarely on page one.

What a good SOC 2 report is worth

None of this is an argument against SOC 2. A Type II report from a competent firm is one of the most useful documents a buyer can get. Independent testers sampled real evidence over months: access granted and removed, changes approved, incidents handled, backups restored. A questionnaire answered by the vendor's own staff can't match that, and a security team that reads reports properly can cut most of its questionnaire.

The value is in the detail: which controls were tested, how, and with what result. The shorthand throws that detail away. Asking whether a vendor is "certified" invites a yes; asking what the report covers invites the evidence.

Better questions to ask

Replace "are you SOC 2 certified?" with questions that make the answer useful:

Which report do you have: Type I or Type II, and what period does it cover?
Does the system description include the service and regions we will use?
Which Trust Services Criteria categories are in scope?
Were there exceptions or a qualified opinion, and how were they resolved?
Which subservice organisations are carved out, and which complementary user entity controls do we need to operate?

Then read the report, at least the opinion, the system description, the exceptions and the user-entity controls. That takes far less time than the questionnaire did.

The same applies to every framework

The pattern isn't unique to SOC 2. "ISO 27001 certified" depends on the certificate's scope; "NIS2 compliant" depends on national law and on reporting procedures no certificate tests; "aligned with NIST CSF" can mean almost anything, because CSF has no certification at all. A framework name is the start of the conversation, not the end of it.

If you are on the vendor side, make this easy: say which report, which period and which scope up front, and show how your controls map to the frameworks your customers use. Our gap analysis and the SOC 2 framework page can help with the mapping, and the SOC 2 guide explains how reports are produced.

Questions

Is there such a thing as SOC 2 certification?

No. A SOC 2 report is an attestation: a licensed CPA firm's opinion on a service organisation's controls against the AICPA's Trust Services Criteria. No certificate is issued.

What should I read first in a SOC 2 report?

The auditor's opinion (is it unqualified?), the scope and system description, the period covered, the exceptions in the test results, and the complementary user entity controls you are expected to operate.

Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.

Why "are you SOC 2 certified?" is the wrong question