SOC 2

SOC 2 (Service Organization Control 2) is an audit framework developed by the AICPA for service organizations to demonstrate the design and effectiveness of their controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports come in two flavors: Type 1 (point-in-time) and Type 2 (over a period of time).

SOC 2 is **not** equivalent to CMMC. SOC 2 is voluntary, audit-firm administered, and applies to any service organization. CMMC is mandatory for defense contractors handling CUI, government-administered, and assesses against NIST SP 800-171.

A contractor that has a SOC 2 Type 2 report is in better shape to pursue CMMC than a contractor with no audit history, but the SOC 2 does not satisfy CMMC.