As federal civilian agencies and the Department of Defense raise cybersecurity expectations across major acquisition vehicles, government contractors face closer scrutiny of third-party risk. Contractors that handle agency data are increasingly asked to show verifiable evidence of information security controls, both to win subcontracts and to hold their place in a prime contractor’s supply chain.
Service Organization Control 2 (SOC 2), developed by the American Institute of Certified Public Accountants (AICPA), is one of the most widely recognized ways to provide that evidence. So how does SOC 2 fit alongside federal requirements such as NIST SP 800-171, CMMC, and FedRAMP? And what do contractors actually need to put in place to meet the Trust Services Criteria?
In this guide, we explain how SOC 2 attestation relates to the AICPA Consulting Standards, break down the Trust Services Criteria, compare SOC 2 with other frameworks GovCons encounter, and outline the steps to prepare for an evaluation.
What is SOC 2, and how does it intersect with AICPA Consulting Standards?
SOC 2 is an AICPA reporting framework that evaluates a service organization’s internal controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. The examination is performed under the AICPA’s attestation standards (SSAE No. 18, including AT-C Section 205) by an independent, licensed Certified Public Accountant (CPA) firm.
The result is an attestation report, not a certification. A CPA firm issues an opinion on your controls. No one “certifies” you, and only a CPA firm can issue the report. The AICPA’s Trust Services Criteria document is the authoritative source for the criteria.
There are two types of reports:
| Type 1 | Type 2 | |
| What it tests | Whether controls are suitably designed | Whether controls operated effectively over time |
| Time frame | A single point in time | An observation period, often between three and twelve months, is set with your auditor |
| Best for | A first milestone, or a quick signal to customers | Prime contractors, agencies, and enterprise buyers who want sustained assurance |
| Effort | Lower | Higher, because evidence must be collected throughout the period |
Where the AICPA Consulting Standards come in
The advisory work that precedes an audit, such as readiness assessments, gap analysis, policy drafting, and control design, is consulting rather than attestation. It falls under the AICPA’s Statement on Standards for Consulting Services (CS Section 100), which requires practitioners to exercise professional competence and due professional care, adequately plan and supervise the work, and obtain sufficient relevant data to support their conclusions.
In practice, this separation matters. The CPA firm performing your SOC 2 examination must remain independent and objective, so the work of getting you ready is usually done by a separate advisory firm. If you plan to use a CPA firm for both readiness and the audit, confirm with that firm how it manages independence requirements before you begin.
Why SOC 2 Matters to Federal Government Contractors
Federal agencies and prime contractors need assurance about the organizations within their supply chains. A SOC 2 Type 2 report provides an independent view of how you protect data and operate your systems, which can shorten vendor risk reviews and reduce the number of custom security questionnaires you have to complete.
It is worth being precise about what SOC 2 does and doesn’t do. SOC 2 is not a requirement on the GSA Multiple Award Schedule or best-value procurements, and it does not replace federal mandates. What it offers is a recognized, commercially accepted attestation that strengthens vendor due diligence, supports your security narrative in proposals, and demonstrates operational maturity, particularly if you provide SaaS, hosting, or managed services.
How SOC 2 Compares with Other Frameworks Govcons Face
One of the most common questions we hear is whether SOC 2 “counts” toward federal requirements. The short answer is that it helps, but it is a different instrument.
| Framework | Who it applies to | Who assesses | How it relates to SOC 2 |
| SOC 2 | Service organizations of any kind | Independent CPA firm | Attestation report on controls against the Trust Services Criteria |
| NIST SP 800-171 / CMMC | Contractors handling Controlled Unclassified Information (CUI) in DoD supply chains | Self-assessment or third-party assessors, depending on the level | Required for CUI. SOC 2 does not substitute, though many controls overlap |
| FedRAMP | Cloud service providers offering services to federal agencies | FedRAMP-accredited third-party assessors and the program office | Required for federal cloud offerings. SOC 2 is not a replacement, but the overlap can reduce duplicated effort. See FedRAMP.gov |
| ISO/IEC 27001 | Any organisation | Accredited certification body | An international ISMS certification. Often pursued alongside SOC 2 |
The AICPA also publishes a mapping between the Trust Services Criteria and NIST SP 800-53 controls, which helps organizations reuse evidence across frameworks. If you work on both commercial and federal engagements, planning your controls once and mapping them to several frameworks saves significant time.
The Trust Services Criteria, Explained
The AICPA defines five categories. Security is mandatory for every SOC 2 examination. The other four are selected based on the services you provide and the commitments you make to customers.
Security (the Common Criteria)
Security is the foundation, and it is organized into nine groups, CC1 through CC9. It protects systems against unauthorized access, disclosure and damage.
| Group | Area | What it looks like in practice |
| CC1 | Control environment | Code of conduct, board or management oversight, defined roles, background checks, and security training |
| CC2 | Communication and information | Documented policies, internal and external communication of responsibilities, and incidents |
| CC3 | Risk assessment | Formal risk assessments, fraud-risk considerations, and tracking of changes that affect controls |
| CC4 | Monitoring activities | Ongoing and periodic control evaluations, tracking, and fixing deficiencies |
| CC5 | Control activities | Policies and procedures that turn risk decisions into day-to-day controls |
| CC6 | Logical and physical access | Role-based access, multi-factor authentication, access reviews, encryption, facility security, secure disposal |
| CC7 | System operations | Vulnerability management, monitoring and alerting, incident response, and recovery |
| CC8 | Change management | Approved, tested, and documented changes to systems and code |
| CC9 | Risk mitigation | Business disruption planning, vendor and third-party risk management |
Availability (A1)
Relevant when you host platforms that agencies or primes rely on. It looks at capacity planning, backups, environmental protections, disaster recovery, and tested recovery procedures.
Confidentiality (C1)
Important when you hold proprietary data, technical drawings, or acquisition-sensitive material. Controls cover data classification, restricted access, encryption, and secure retention and disposal.
Processing integrity (PI1)
Applies when your systems perform transactions or calculations on behalf of customers. It focuses on whether processing is complete, valid, accurate, timely, and authorized.
Privacy (P1)
Applies when you collect or handle personal information, such as agency personnel data or citizen records. It addresses notice, consent, collection limits, use, retention, access, and disclosure.
How to choose your criteria: start with the commitments in your contracts and customer security requirements. If you promise uptime, include Availability. If you hold sensitive customer data, include Confidentiality. If you process personal information, include Privacy. Adding criteria increases scope and effort, so include what your customers will actually ask about.
Frequently asked questions
- Is SOC 2 a certification? No. It is an attestation report issued by an independent CPA firm. You may hear “SOC 2 certified” informally, but the accurate term is a SOC 2 report or attestation.
- Do federal contractors have to get SOC 2? No federal regulation makes SOC 2 universally mandatory. It is typically driven by prime contractor, agency, or commercial customer requirements.
- Does SOC 2 satisfy CMMC, NIST SP 800-171 or FedRAMP? No. Those are separate requirements, each with its own assessment process. SOC 2 can help by establishing strong control foundations that overlap with them.
- Should we begin with Type 1 or Type 2? A Type 1 report can be a useful first milestone, but most primes and agencies ultimately prefer Type 2 because it shows controls operating over time.
- How long does it take? It depends on your starting maturity, scope, and the observation period you choose. Organizations with documented, working controls move faster than those starting from scratch.
- Who can see the report? SOC 2 reports are restricted-use documents, typically shared with customers and prospects under NDA.
Key takeaways
- SOC 2 is an AICPA attestation framework, examined by independent CPA firms, covering security, availability, processing integrity, confidentiality, and privacy.
- Readiness work, including gap assessments, policy drafting, and control design, is a form of consulting. It falls under the AICPA Consulting Standards and should remain separate from the attestation itself.
- Security (the Common Criteria, CC1-CC9) is mandatory. The other criteria are chosen based on your contracts and customer commitments.
- SOC 2 complements, but does not replace, NIST SP 800-171, CMMC, and FedRAMP.
- A Type 2 report demonstrates controls operating over time and carries the most weight with primes and agencies.
Prepare your operations for SOC 2 attestation
Meeting the Trust Services Criteria takes more than buying security tools. It means aligning workflows, governance, and technical controls with AICPA guidance and being able to prove it with evidence an auditor will accept.
iQuasar LLC provides SOC 2 readiness and compliance support for government contractors, including gap assessments, policy drafting, and control preparation tailored to your contracts and customers. We prepare you for the examination, and an independent CPA firm of your choosing performs the attestation. Connect with our team to discuss your compliance objectives.
