Understanding SOC 2 Attestation

SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls under the AICPA SSAE 18 standard and issues an independent opinion in a report — there is no "SOC 2 certificate." Claiming to be "SOC 2 certified" is technically incorrect; the accurate phrasing is "SOC 2 attestation" or "SOC 2 report."

Only an independent, licensed CPA firm can perform a SOC 2 attestation and sign the report. Consultants (including Tranquility Cybersecurity) prepare you for the audit — building controls, collecting evidence, and running readiness assessments — but the attestation opinion itself must come from a separate CPA firm to preserve independence.

A Type I report attests to the suitability of control design at a single point in time. A Type II report goes further: the CPA tests whether those controls operated effectively across an observation window, typically 3-12 months. Type II is the report most enterprise customers require because it demonstrates sustained operating effectiveness, not just design.

A SOC 2 report has five core parts: management's assertion, the independent auditor's opinion, the system description, the Trust Service Criteria with mapped controls, and (for Type II) the detailed results of the auditor's tests across the observation window. Security (the Common Criteria, CC1-CC9) is mandatory; Availability, Confidentiality, Processing Integrity, and Privacy are optional add-ons.

A SOC 2 report covers a defined period and does not formally "expire," but customers generally expect a report dated within the last 12 months. Most organizations undergo an annual Type II attestation so they always have current coverage for security questionnaires and procurement reviews.