Auditor engagement letter
The contract that locks examination scope, period, fees, and responsibilities before fieldwork. Related: Auditor engagement letter
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
Reference
SOC 2 glossary
TL;DR. Canonical short definitions for observation window, Type 1/Type 2, TSC, questionnaires, and related founder terms. Educational only.
A
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
C
Common Criteria (Security)
The Security category of the Trust Services Criteria—often the scope of a first SOC 2 report. Related: Common Criteria (Security)
Sources: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)
CAIQ
Cloud Security Alliance Consensus Assessments Initiative Questionnaire—yes/no questions mapped to the Cloud Controls Matrix. Related: CAIQ
Sources: What is CAIQ?; STAR Level 1: Security Questionnaire (CAIQ v4.1)
CAIQ Lite
A streamlined CAIQ/CCM path oriented to SMEs and startups (see CSA STAR materials). Related: CAIQ Lite
Sources: CSA STAR
Control owner
The named person accountable for operating a control and producing its evidence on cadence. Related: Control owner
Sources: ProofWindow educational planning ranges
D
Deal-triggered start
Beginning a SOC 2 program when a named deal, RFP, or recurring questionnaire makes the report load-bearing—not before. Related: Deal-triggered start
Sources: ProofWindow educational planning ranges
E
Evidence pack
The curated set of policies, tickets, screenshots, and logs that show controls existed and operated for the examiner. Related: Evidence pack
Sources: ProofWindow educational planning ranges
O
Observation window
The period a Type 2 examination covers to test whether controls operated effectively—not only whether they were designed. Related: Observation window
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
S
SOC 2 Type 1
A point-in-time examination of the design of controls relevant to selected Trust Services Criteria. Related: SOC 2 Type 1
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
SOC 2 Type 2
An examination of design and operating effectiveness of controls over an observation window. Related: SOC 2 Type 2
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
SIG Lite
Shared Assessments Standardized Information Gathering Lite template—commonly used for lower-risk or preliminary vendor questionnaires. Related: SIG Lite
Sources: Shared Assessments (SIG)
T
Trust Services Criteria (TSC)
AICPA criteria used in SOC 2 examinations: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Related: Trust Services Criteria (TSC)
Sources: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)
Sources
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- primary 2017 Trust Services Criteria (With Revised Points of Focus – 2022) — AICPA & CIMA — Authoritative TSC document (Security/Availability/Processing Integrity/Confidentiality/Privacy).