A SOC 2 report can address more than the usual Trust Services Criteria. The added work must be clearly defined and use suitable criteria. This is often called SOC 2+.
Start with the question your customer needs answered. Adding framework names to a report does not automatically give the customer the assurance they need.
What can be added?
These examples show different kinds of additional work. They are not a standard package:
- Facility facts: examine specified claims about a facility, such as the size of a contracted space.
- Availability records: examine historical availability data against agreed measurement rules.
- Privacy practices: examine whether the organization followed a specified statement of privacy practices.
- Specified regulatory requirements: examine agreed requirements, such as selected HIPAA Security Rule requirements. This does not establish compliance with every HIPAA obligation.
- Another control framework: evaluate controls against suitable additional criteria, such as an agreed version of the Cloud Security Alliance’s Cloud Controls Matrix.
Define the extra work before requesting a quote
- What question must the report answer?
- Which service, location and period need to be covered?
- Which requirements and edition will be used?
- What records are available to support the extra claims?
- Does another provider perform a control that needs to be examined?
- Will the intended customer accept the resulting report?
For example, a customer may need assurance about monthly uptime figures. That is a different question from whether the company has controls intended to maintain availability. Agree how uptime is calculated and what evidence supports the figures.
What changes in the examination?
The CPA evaluates whether the additional criteria are suitable and available to the intended users. The engagement agreement identifies the added criteria and responsibilities. Management’s assertion also addresses the additional evaluation.
Third-party dependencies can change what is feasible. Discuss them before assuming that controls operated by another provider can be covered in your report.
What SOC 2+ does not do
- A mapping to another framework is not the same as examining compliance with it.
- Adding criteria does not automatically provide a separate certification or replace a regulator’s requirements.
- Combining work does not guarantee lower cost. Additional evidence and testing may be needed.
- There is no universal sample size for the added work. Testing depends on the agreed scope and the auditor’s assessment.
Keep the underlying SOC 2 scope clear. Describe the added work precisely rather than saying the report covers every compliance requirement.
Source and further reading
See the AICPA SOC 2 guide, paragraphs 2.184–2.189, for examinations addressing additional criteria. The examples above simplify the use cases previously discussed on this page; they are not new standards.
If you’re ready to find out more about how to enhance your current SOC 2 or need help starting you’re first and want to ask a few questions to an expert, please reach out to Find a SOC 2 Provider via the link provided or contact form below to speak with a qualified professional.
