AICPA SOC 2 Type II Trust Services Criteria

SOC 2 Agreement Auditor & Evaluator

Audit cloud SaaS contracts and MSA vendor agreements against AICPA Security, Availability, Processing Integrity, and Confidentiality criteria.

Step 1: Choose Processing Engine

Step 2: Select Scan Objective

Select Active Compliance Frameworks:1 Selected

SaaS Vendor SOC 2 Contract Evaluation Guide

Essential security and processing integrity terms required in enterprise Master Services Agreements (MSAs).

SOC 2 (Service Organization Control 2) audits evaluate a vendor's internal security controls against AICPA Trust Services Criteria. When procuring B2B cloud software, enterprise legal teams must ensure vendor agreements incorporate mandatory SOC 2 safeguards.

1. Trust Services Criteria (TSC) Reference

Vendor agreements should explicitly reference ongoing alignment with AICPA Security and Confidentiality criteria.

2. Processing Integrity & Continuous Audit

Contracts must mandate system availability monitoring, processing data integrity, and annual SOC 2 Type II audit report delivery.

3. Confidentiality Commitments

Strict safeguards protecting confidential information from unauthorized collection, use, or disclosure.

4. Incident Response & Disaster Recovery

Formal procedures detailing security incident management, customer notification, and business continuity plans.