3 Things CTO's Should Know About SOC 2 Compliance

Within the SOC 2 framework, two crucial categories—privacy and confidentiality—play distinct roles in safeguarding sensitive data. Our latest article outlines each category and the differences between the two.

In general, all SOC 2 reports must cover the trust services criteria relevant to security, so that is a good place to start.

There is nuance to this question, and other well-meaning and very smart people that I respect might give a different answer. But within the volumes of literature that set the standards, the true answer is this: There are absolutely no control requirements for SOC 2 reports.