What SOC 2 Type II means for your finance data

If you’re bringing a new tool into the finance stack, your security team will ask for its SOC 2 Type II report. Here’s what it is and how to read it.

Type I versus Type II

A Type I report says controls were designed properly on one day. A Type II report says they actually worked over a period, usually twelve months. Ask for Type II.

Read the exceptions

The most useful pages are the exceptions: places where the auditor found a control didn’t operate as described. A few minor ones are normal; ask how each was fixed.

Check the scope

Make sure the systems that will hold your data are in scope. Kestrel’s report covers the product, the infrastructure it runs on and the people who support it.