There is no such thing as "SOC 2 certified"

Search any vendor’s security page and there is a decent chance it says the company is "SOC 2 certified". It is one of the most common phrases in B2B marketing and it describes something that does not exist. Understanding why is the fastest way to become a better reader of vendor evidence, because the correct vocabulary tells you exactly what to ask for. This explainer covers what SOC 2 produces, why the wrong word spreads, what it hides, and how the index records the framework without it.

0

Certificates issued by a SOC 2 engagement

The output is an attestation report

66%

of B2B buyers check for SOC 2 before signing

Agency, SOC 2 statistics roundup

45

Vendors with public SOC 2 facts in the CertReports index

18 September 2026

What SOC 2 actually is

SOC 2 is an attestation engagement performed by a licensed CPA firm under the AICPA attestation standards. The service organisation writes a description of its system and asserts that its controls meet the Trust Services Criteria. The auditor examines that description and those controls and issues an opinion. The output is a report addressed to the service organisation, with restricted distribution.

Despite it commonly being referred to as a "SOC 2 certification," SOC 2 is an attestation. SOC 2 auditors do not certify that a given company has met the standard; instead, the report attests to what they’ve observed in the organization’s security program.

Nothing in that process issues a certificate, sets a pass mark, or creates a public register. A vendor can have an unqualified opinion, a qualified one, or an adverse one. Two vendors with "SOC 2" on their pages can differ by report type, period, criteria in scope, carve-outs and exceptions, and the badge shows none of it.

Why the wrong word spreads

Three reasons. Buyers ask "are you SOC 2 certified?" because the phrase is familiar from ISO, where a certificate genuinely exists, and vendors answer in the same words. Compliance platforms sell badges, and a badge looks like a certificate. And "we hold a SOC 2 Type II report for the twelve months to 31 March 2026, issued by a named firm" is longer than "SOC 2 certified" and fits worse on a landing page. None of these is dishonest. All of them lose information a reviewer needs.

What the phrase hides

The comparison with ISO 27001

ISO 27001 is a certification: an accredited certification body audits an information security management system against the standard and issues a certificate with a scope, sites and a three-year validity subject to annual surveillance. SOC 2 is an attestation: a CPA firm examines controls against criteria and issues an opinion for a period. The words are not interchangeable, and the difference decides what evidence exists. ISO produces a document you can check for edition, scope and expiry; SOC 2 produces a report you must read for type, period, criteria and exceptions.

The four facts to ask for

1. Report type: Type I (design at a point in time) or Type II (design and operating effectiveness over a period). See Type I versus Type II.
2. Period end date, and a bridge letter if it is more than three months old.
3. Trust Services Criteria in scope. Security is mandatory; Availability, Processing Integrity, Confidentiality and Privacy are optional.
4. The CPA firm. CertReports links firms to their auditor pages so you can see how many reports they sign.

How CertReports records it

The index never uses the phrase as a state. A SOC 2 row records the report type, period end, auditor and criteria, each with a capture date and a snapshot. When a page only shows a badge, the row is vendor-stated; when the auditor confirms the engagement, it becomes verified by auditor. There is no registry to verify against, which is why SOC 2 has fewer verified rows than any registry-backed framework. See the SOC 2 hub for every vendor with public evidence, and the reading guide for what to do with the report once you have it.