SOC 2

An audit report on a service provider’s security, availability and confidentiality controls, issued under US AICPA standards. Buyers of SaaS and hosting often ask for a SOC 2 Type II report.

Also called: SOC 2 Type II

Related terms

ISO/IEC 27001

The international standard for information security management. Certification by an accredited auditor is a common mandatory requirement for cloud, data and managed-service tenders.

FedRAMP

The US federal program that authorizes cloud services for government use against a standard set of security controls. Cloud products sold to US agencies usually need a FedRAMP authorization.