SOC 2 Glossary

SOC 2 is an AICPA attestation over how your organization designs and operates controls relevant to the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Clear language matters: when engineers say “system component,” lawyers say “commitment,” and auditors ask for “control activities,” small differences in wording can derail scope, testing, and evidence. This glossary standardizes the terms you’ll see in scoping documents, control descriptions, and the final report—so your team and your auditor are speaking the same language. Whether you’re drafting your system description, tightening controls for a Type II period, or aligning stakeholders ahead of fieldwork, these definitions give you a shared, audit-ready vocabulary to move faster and avoid rework.