# SOC 2 and the Trust Services Criteria **Entity class:** Commercial assurance framework and examination ## Definition **SOC 2** is an AICPA reporting framework for an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy under the Trust Services Criteria. SOC 2 overlaps with federal assurance in areas such as identity, access, change management, monitoring, incident response, and evidence. It is not an Intelligence Community framework and is not equivalent to a federal ATO, CNSSI 1253 implementation, or classified-system authorization. ## Relationships - **commercial position:** [[wiki/Assurance Continuum|Assurance Continuum]]. - **federal comparator:** [[wiki/NIST SP 800-53|NIST SP 800-53]]. - **supports vendor evidence for:** [[wiki/Federated Trust Fabric|Federated Trust Fabric]], subject to agency-specific requirements. ## Sources / Provenance - [AICPA — SOC suite and Trust Services Criteria](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2) - [NIST — SP 800-53 crosswalk caution](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)