Compliance: SOC 2 Type II
This course covers SOC 2 Type II as an attestation: an auditor's opinion with a negotiated scope, delivered as a report that customers read under NDA. It explains the report's four sections, the four possible opinions and how exceptions appear in the test-of-controls matrix. It treats the observation period as the central engineering constraint and shows the evidence a Rails team produces each month. It also covers choosing Trust Services Criteria, complementary user entity controls, subservice organizations, readiness, cost and the comparison with ISO 27001.
What you'll learn
- ✓How to read a SOC 2 report's four sections, its opinion types and its exceptions
- ✓Why the observation period requires controls to operate every month of the window
- ✓Which dated records a Rails team produces as evidence for a Type II audit
- ✓How each Trust Services Criterion added becomes scope you must sustain
- ✓What complementary user entity controls and the carve-out and inclusive methods mean
- ✓How the gap assessment, readiness period and engineering cost fit together, and how SOC 2 compares with ISO 27001
The report is the product
Lesson 6 of the senior course "Compliance: the regulatory landscape" drew the line this whole course lives on. SOC 2 is an attestation, not a certification. "SOC 2 certified" is a category error, even though it's the phrase most engineers reach for. The senior course "Compliance: ISO 27001" spent…
Read the full lesson free →Curriculum
7 lessonsThe report is the product
SOC 2 is an attestation delivered as a report with four sections, and the observation period shapes Type II.
Reading the report: opinions and exceptions
The four auditor opinions, where exceptions live in the test matrix, and why the system description comes first.
The observation period: continuous, not a snapshot
Auditors sample months across a three to twelve month window, so evidence must come from normal work.
Evidence as a build artifact
Access reviews, PR history, offboarding tickets, scans, restore tests and incident records as dated, attributable Type II evidence.
Choosing criteria and the cost of scope
Security is mandatory, the other four criteria are chosen, and each one adds evidence to sustain all period.
Complementary controls and subservice organizations
Why a cloud provider's SOC 2 leaves your application uncovered, and how carve-out and inclusive methods differ.
SOC 2 or ISO 27001: closing the compliance block
Gap assessment, readiness, recurring engineering cost, bridge letters and how SOC 2 compares with ISO 27001.