What is SOC 2?
SOC 2 (System and Organization Controls 2) is an assurance report by an independent auditor stating whether a service provider has properly designed its controls for security, availability, processing integrity, confidentiality and privacy and, for Type II, whether those controls actually operated effectively over a period of time. The framework comes from the AICPA, the American professional body for accountants, and uses the Trust Services Criteria as its benchmark. For OT organisations, SOC 2 is above all a way to assess suppliers that provide cloud services, remote access or management of IT and OT systems.
SOC 2 is not a certificate but a report: you receive a description of the system, the controls tested, the test results and the auditor’s opinion.
🧠 How is SOC 2 structured?
A SOC 2 examination assesses controls against the Trust Services Criteria (TSC). The current version dates from 2017; in 2022 the AICPA revised the explanatory points of focus, but left the criteria themselves unchanged. The TSC have five categories:
| Category | Mandatory? | What does it cover? | Example in an OT context |
|---|---|---|---|
| Security (common criteria) | Always | Protection against unauthorised access and misuse | MFA and Least Privilege for remote sessions to PLCs |
| Availability | Optional | Availability as agreed in a contract or SLA | Recovery of a hosted Historian or SCADA server |
| Processing Integrity | Optional | Complete, accurate and timely processing | Correct transfer of production and quality data |
| Confidentiality | Optional | Protection of confidential information | Recipes, drawings and process parameters |
| Privacy | Optional | Handling of personal data | User data in a cloud CMMS |
The mandatory common criteria are split into nine series. CC1 to CC5 follow the five components and seventeen principles of the 2013 COSO internal control framework: control environment, communication and information, risk assessment, monitoring activities and control activities. They are followed by CC6 (logical and physical access), CC7 (system operations, including detection and incident handling), CC8 (change management) and CC9 (risk mitigation, including vendor risk). The organisation decides for itself which optional categories it brings into scope.
🔄 What is the difference between Type I and Type II?
| Feature | SOC 2 Type I | SOC 2 Type II |
|---|---|---|
| Tests | Design and existence of controls | Design, existence and operating effectiveness |
| Time frame | A single point in time | A period, in practice usually 6 or 12 months |
| Testing | Description and inspection | Samples taken across the whole period |
| Value to customers | Limited; shows that the plan is sound | High; shows that it also works in practice |
| Typical use | First report for a new service | Annual accountability to customers |
A Type II report always lags behind the present. Suppliers therefore often issue a bridge letter: a statement by management that no material changes have occurred between the end of the reporting period and today. That letter is not an auditor’s opinion.
🔁 How does SOC 2 relate to other standards?
| Framework | Type | Relationship with SOC 2 |
|---|---|---|
| SOC 1 / ISAE 3402 | Assurance report | Focused on financial reporting, with control objectives that the provider defines itself; SOC 2 tests against fixed criteria |
| SOC 3 | Assurance report | Public summary of a SOC 2 examination, without the test details |
| ISO 27001 | Certification | Management system with a certificate; much overlap with the controls in ISO 27002 |
| IEC 62443-2-4 | Requirements for service providers | OT-specific (integration and maintenance of automation systems); SOC 2 does not replace it |
| NIS2 / Dutch Cybersecurity Act | Legislation | Requires supply chain security; a SOC 2 report is useful evidence in supplier assessments |
In the United States only licensed CPA firms may issue a SOC 2 report, under the attestation standard AT-C 205. Dutch IT auditors (RE) and chartered accountants (RA) do not hold that US licence and work under the international assurance standard ISAE 3000 instead. NOREA, the Dutch professional association of IT auditors, published guidance in 2016 for a SOC 2-equivalent report under ISAE 3000, using the Trust Services Criteria as the benchmark and a layout similar to ISAE 3402. Such a report tests the same criteria, but formally it is not an AICPA SOC 2 report.
🏭 Why is SOC 2 relevant to OT environments?
With OT convergence, more and more work moves to external parties: cloud platforms for IIoT and analytics, remote maintenance by machine builders, hosted historians, and firewall or SIEM management by an MSSP. Every party with access to your network is a potential attack path, as described under supply chain risk.
A SOC 2 report helps you assess those parties on, among other things:
- Access management - how technicians’ accounts are created, reviewed and revoked, and whether role-based access control works
- Monitoring and logging - whether unusual behaviour in the management environment is detected and followed up
- Change Management - whether changes to the service are tested, approved and recorded
- Backup and recovery - whether backups are tested and recovery objectives are met, see also Disaster Recovery
- Patch management and vulnerability management - how quickly vulnerabilities in the provider’s own infrastructure are fixed
- Incident Management - how incidents are handled and how customers are informed
Bear in mind that the scope of a SOC 2 report is the service provider’s system, not your plant. A cloud provider with a clean SOC 2 report says nothing about the security of the edge gateway on your shop floor, or about the laptop of the service engineer who works on site. For that OT-specific side, IEC 62443-2-4 is a better fit, within the broader framework of IEC 62443. This matters most for suppliers to critical infrastructure.
The way the same control is implemented also differs. A SaaS provider’s SOC 2 report usually describes change management as a DevOps process with code reviews and automated tests, and logging at application and system level. In OT, changes go through a FAT, a SAT and version control of PLC programs, and logging is needed at network and controller level. If you buy an OT service, such as SCADA-as-a-Service, a hosted historian or a remote access platform, check that precisely that platform is in the system description. Only then does the report say anything about the risks to your production.
🔧 How do you review a supplier’s SOC 2 report?
A SOC 2 report easily runs to dozens of pages. Read it in a targeted way, as an auditor would, in this order:
- The auditor’s opinion - an unqualified opinion is the goal. A qualified opinion, an adverse opinion or a disclaimer of opinion calls for a conversation with the supplier.
- Scope and system description - check that the service you use, the locations and the relevant TSC categories are included. If Availability is missing while your operations depend on the service, that is a gap.
- Period - check whether it is a Type II and how old the period is. For a report more than a few months old, ask for a bridge letter.
- Subservice organisations - under the carve-out method, the data centre or hyperscaler, for example, has not been tested. In that case, ask for their reports too and check which complementary subservice organisation controls (CSOCs) the provider expects from them.
- Exceptions - read the deviations in the test results and management’s response. A single missed access review weighs differently from structurally missing logging.
- Complementary User Entity Controls (CUECs) - controls that you must operate, such as promptly revoking accounts of departed staff. Without those controls, the assurance of the report does not fully apply to your organisation.
Record the outcome in your third-party risk management and link any shortcomings to contract terms or additional measures, such as session recording for remote access.
🇪🇺 How do you use SOC 2 under Dutch and EU rules?
The Dutch Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026) transposes the duty of care from NIS2, including supply chain security. Essential and important entities must know and manage the risks posed by their direct suppliers. SOC 2 is not a legal requirement, but it is practical and widely used evidence, especially for American cloud and SaaS providers. European suppliers more often offer an ISO 27001 certificate or an ISAE 3000 report. For products with digital elements, the Cyber Resilience Act applies in full from 11 December 2027; it governs product security, whereas SOC 2 is about the service.
A realistic procurement requirement for an OT cloud provider is therefore: a SOC 2 Type II report (or ISAE 3000 equivalent) with Security and Availability in scope, no older than twelve months, supplemented by a questionnaire on OT-specific topics.
❓ Frequently asked questions
Is SOC 2 a certification?
No, SOC 2 is an assurance report, not a certificate. The auditor gives an opinion on the described controls, and the customer reads the scope, the test results and the exceptions for themselves. This sets SOC 2 apart from ISO 27001, where a certification body issues a certificate.
How long is a SOC 2 report valid?
A SOC 2 report has no formal period of validity, but customers usually accept it for up to about twelve months after the end of the reporting period. That is why suppliers commission a new SOC 2 Type II examination every year. For the months in between, they often issue a bridge letter.
Which Trust Services Criteria are mandatory in SOC 2?
Only the Security category, the so-called common criteria, is mandatory in every SOC 2 examination. Availability, Processing Integrity, Confidentiality and Privacy are chosen by the service provider, based on the service and customer expectations. Always check which categories a SOC 2 report actually covers.
What is the difference between SOC 2 and SOC 3?
A SOC 2 report contains the system description, the controls tested and the test results, and is intended only for customers and their auditors. SOC 3 is a short, public version of the same examination without those details. For a serious supplier assessment you need the SOC 2 report.
Can a Dutch or European organisation obtain a SOC 2 report?
Yes, a Dutch organisation can obtain a SOC 2-equivalent report under the ISAE 3000 assurance standard, following the guidance NOREA published in 2016. That report uses the same Trust Services Criteria as SOC 2. Organisations that need an AICPA report carrying the SOC 2 name engage a US CPA firm or a network firm with a US licence.
Is SOC 2 enough to assess an OT supplier?
No, SOC 2 is rarely enough for an OT supplier, because the framework was not designed specifically for industrial automation. SOC 2 covers the provider’s IT controls, but not topics such as secure engineering workstations, changes to PLC programs or agreements on maintenance windows. Combine SOC 2 with the requirements of IEC 62443-2-4 and your own remote access agreements.
📌 In summary
SOC 2 is an AICPA assurance report on a service provider’s controls, tested against the Trust Services Criteria. Security is always in scope; the other four categories are optional. Type II shows that controls operated over a period. For OT it is useful evidence for cloud and managed service providers, provided you check the scope, subservice organisations, exceptions and your own CUECs.
SOC 2 shows how well a supplier controls its own environment, but it does not cover the OT-specific risks at your site; combine it with IEC 62443-2-4 and your own agreements.