Every IT provider says they take security seriously. It’s on every website, in every proposal, and in every sales call. The problem is that “we take security seriously” costs nothing to say.
So how do you tell the difference between a provider that actually runs a disciplined operation and one that just describes itself that way?
One of the clearest answers is a SOC 2 Type II report. It’s one of the few ways to see how a provider behaves when nobody is watching, because for months, somebody was.
First, What SOC 2 Actually Is
SOC 2 is an audit framework created by the American Institute of Certified Public Accountants (AICPA). It evaluates how a service organization protects the systems and data it’s responsible for, measured against a set of standards called the Trust Services Criteria.
There are five criteria. Security is required in every SOC 2 audit. The other four are optional and included based on what the provider does:
- Security: Systems are protected against unauthorized access.
- Availability: Systems are up and usable as promised.
- Processing integrity: Systems do what they’re supposed to do, completely and accurately.
- Confidentiality: Information designated as confidential stays that way.
- Privacy: Personal information is collected, used, and disposed of properly.
The audit is performed by an independent CPA firm. Not by the provider, and not by a software vendor selling a badge.
One note on language: you’ll often hear SOC 2 called a “certification,” and we use the term ourselves because it’s how most people search for it. Technically, it’s an attestation: an independent auditor’s formal opinion, backed by a detailed report. That distinction matters, because the report is where the real information lives.
Type I vs. Type II: The Difference That Matters
There are two kinds of SOC 2 reports, and they answer very different questions.
A Type I report looks at a single point in time. The auditor reviews the provider’s controls and confirms they’re designed appropriately. It’s a snapshot: on this date, the right policies and safeguards existed.
A Type II report looks at a period of time, usually somewhere between three and twelve months. The auditor tests whether those controls actually operated, consistently, throughout that entire window.
It’s the difference between a restaurant passing an inspection it scheduled, and a restaurant that stays clean every day for a year while someone checks at random.
Anyone can have a good policy on paper. A Type II report shows whether the policy was followed on a busy Tuesday in March.
What Auditors Actually Check
For an IT provider, a Type II audit gets specific. Auditors don’t take the provider’s word for anything. They pull samples and ask for evidence. Typical areas include:
Who Has Access, and Why
Are user accounts created and removed through a defined process? When a technician leaves, is their access to client systems revoked promptly? Are privileged accounts reviewed on a schedule? Auditors pick real examples and check the records.
How Changes Are Made
When the provider changes a firewall rule, deploys an update, or reconfigures a system, is the change requested, approved, and documented? Or does someone just log in and make it?
Whether Monitoring Actually Happens
It’s easy to say you monitor systems around the clock. Auditors look for the alerts, the logs, and evidence that someone responded.
Backups and Recovery
Are backups running as scheduled? More importantly, are restores tested? A backup nobody has ever restored is a hope, not a plan.
Incident Response
Is there a documented process for handling a security incident, and is there evidence it’s followed?
People and Vendors
Are employees screened and trained on security? Are the provider’s own vendors evaluated for risk?
Any control that failed during the audit period is documented in the report as an exception. That’s one of the most useful parts of the report, and one of the most overlooked.
Why This Matters for Your Business
An IT provider typically holds the keys to everything: administrator access to your email, your files, your firewall, and your backups. If their house isn’t in order, yours isn’t either, no matter how careful your own team is.
A SOC 2 Type II report also helps with obligations you may already have. Cyber insurance applications, client security questionnaires, and compliance requirements increasingly ask how your vendors are vetted. Being able to point to an independently audited provider makes those conversations much simpler.
It’s also a real investment for a provider to make. Getting there takes documented processes, tooling, and months of evidence collection, followed by a new audit every year. Many small IT providers haven’t gone through it. That doesn’t automatically make them bad providers, but it does mean you’re relying on their description of how they operate rather than an independent one.
Ask yourself: If your IT provider’s practices were independently audited tomorrow, how confident are you in what the auditor would find?
Questions to Ask Any IT Provider
Whether you’re evaluating a new provider or checking on your current one, these questions cut through the marketing quickly:
- Do you have a SOC 2 report, and is it Type I or Type II? If it’s Type I, ask whether a Type II audit is underway.
- Can we see the report? SOC 2 reports are usually shared under a nondisclosure agreement. A provider that won’t share it at all, even under NDA, deserves a follow-up question.
- What period does it cover? A report whose audit period ended long ago tells you less. If there’s a gap since the period ended, ask for a bridge letter covering it.
- Which Trust Services Criteria are included? Security is always required. If uptime is critical to your business, check whether availability is in scope too.
- Which services and systems are covered? Make sure the services you’d actually be buying are part of what was audited.
- Were there any exceptions, and how were they fixed? A report with a few exceptions and clear remediation is normal. How a provider talks about theirs tells you a lot.
- What are we responsible for? Every SOC 2 report lists complementary user entity controls: the things the customer has to do for the provider’s controls to work. Know what’s on your side of the line.
If a provider doesn’t have a SOC 2 report, many of these questions still work. Ask how they handle access removal, change approval, and backup testing, and ask to see evidence. A well-run provider will have answers.
How SAF Approaches It
SAF maintains a SOC 2 Type II report because our clients trust us with access to the systems their businesses run on. We think that trust should be verified independently, not just asserted.
For the education, hospitality, nonprofit, and financial organizations we support in Denver, Hawaii, and Oregon, it means the practices we describe in a proposal are the same ones an auditor tested, over time, with evidence.
If you’re evaluating IT providers, or just want to know how your current one measures up, we’re happy to walk through what our report covers and how to read one.
Contact SAF to talk through what a SOC 2 Type II provider looks like in practice →
Syn Ack Fin (SAF) is a managed IT services provider based in Denver, Colorado. Since 2001, we’ve helped small and mid-sized businesses build the IT infrastructure and security practices they need to operate with confidence.
