SOC 2
ActiveCore framework
Best for: Any technology or cloud service provider that handles customer data and needs to prove its security posture to enterprise buyers. SaaS companies, managed service providers, data centers, and IT outsourcing firms run into SOC 2 requirements during sales cycles. There is no revenue or size threshold; even a five-person startup selling to a Fortune 500 will be asked for a SOC 2 Type II report.
| Mandatory? | Voluntary — required by enterprise procurement |
|---|---|
| Who validates? | Licensed CPA firm (SSAE 18). No self-assessment. |
| Renewal | Typically annual |
| Observation period | Type II: 3–12 months |
| Governing body | American Institute of Certified Public Accountants (AICPA), 2017 TSC (2022 revised). Official source |
Get started
Point the module source at the SOC 2 endpoint and pin a version range you reviewed:
module "..." {
source = "soc2.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}soc2.compliance.tf lists every SOC 2 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Encryption at Rest | Covers encryption configuration across API Gateway caches, Backup recovery points, and CloudFront distributions. Any service where encryption is available but not enabled will surface as a finding. | Your encryption policy document, KMS key rotation schedules, and ensuring your encryption standards are reflected accurately in the SOC 2 system description. |
| Encryption in Transit | Checks CloudFront distribution TLS enforcement and field-level encryption settings, including whether HTTPS is required and HTTP-to-HTTPS redirect policies are in place. | TLS version floor decisions (e.g., requiring TLS 1.2 minimum), custom SSL certificate management, and documenting encryption-in-transit requirements in vendor agreements. |
| Audit Logging | Covers CloudTrail (multi-region trail, S3 data events for both read and write), API Gateway stage logging, AppSync field-level logging, Athena workgroup logging, Bedrock invocation logging, and CloudFront access logging. | Log review cadence, SIEM integration, alert tuning, and demonstrating to the auditor that logs are reviewed on a defined schedule. Evidence of actual review is what assessors ask for. |
| Backup and Recovery | Confirms backup plans exist in configured regions, enforces minimum 35-day retention, validates deletion protection on recovery points, and checks that individual recovery points meet retention requirements. | RPO and RTO definitions, annual restoration testing, documented recovery procedures, and mapping backup coverage to the commitments stated in your system description. |
| Certificate Management | Flags ACM certificates expiring within 30 days so teams can renew before expiration triggers an availability or security event. | A certificate lifecycle management process, ownership assignment for renewals, and tracking any certificates issued outside ACM. |
Controls by category
90 of 142 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 52 are Mapped only: SOC 2 lists them, no compliance.tf module checks them.
Data Retention and Backup (A1.2, A1.3)
Evidence here centers on backup plan configuration and regional coverage. Assessors want to see plans covering all in-scope systems with retention periods that match the organization's stated commitments, deletion protections on recovery points, and backup jobs running in every region where workloads operate. The typical gap: backups are configured in the primary region but absent from disaster recovery regions.
| Control | Status |
|---|---|
| Backup plan rules should retain recovery points for at least 35 days | Mapped |
Encryption and Data Protection (CC6.1, CC6.7, C1.1)
The most common finding in this category is selective encryption: some services are protected while adjacent components like API Gateway caches are left in plaintext. Assessors check TLS enforcement across all in-scope endpoints, key management practices, and whether default encryption settings are actually applied to caches and storage throughout the environment.
Logging and Monitoring (CC7.1, CC7.2, CC7.3)
This category draws the most scrutiny. Auditors verify that logging is enabled across all in-scope services, that logs are retained for the full review period, and that someone actually reviews them. They check CloudTrail coverage across all regions (not just the primary region), S3 data event logging for both reads and writes, and evidence of log integrity controls. Gaps for newer services like Bedrock are a frequent deficiency, particularly when teams added those services mid-period.
Additional controls (134)
AWS AppSync (1)
| Control | Status |
|---|---|
| AppSync API caches should have encryption in transit enabled | Enforced |
AWS Certificate Manager (1)
| Control | Status |
|---|---|
| ACM certificates should not use wildcard certificates | Mapped |
AWS CloudTrail (4)
AWS CodeBuild (2)
AWS Database Migration Service (3)
AWS IAM (1)
| Control | Status |
|---|---|
| IAM password policies should have strong configurations | Mapped |
AWS KMS (1)
| Control | Status |
|---|---|
| KMS CMK rotation should be enabled | Enforced |
AWS Lambda (4)
AWS Step Functions (1)
| Control | Status |
|---|---|
| Step Functions state machines should have logging enabled | Enforced |
AWS WAF (1)
| Control | Status |
|---|---|
| WAFv2 rules should have CloudWatch metrics enabled | Enforced |
Amazon CloudFront (1)
| Control | Status |
|---|---|
| CloudFront distributions should use the recommended TLS security policy | Enforced |
Amazon CloudWatch (3)
Amazon CloudWatch Logs (1)
| Control | Status |
|---|---|
| Log groups should have encryption at rest enabled | Enforced |
Amazon DocumentDB (1)
| Control | Status |
|---|---|
| DocumentDB clusters should have deletion protection enabled | Mapped |
Amazon DynamoDB (3)
Amazon DynamoDB Accelerator (1)
| Control | Status |
|---|---|
| DynamoDB Accelerator clusters should be encrypted in transit | Mapped |
Amazon EBS (2)
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
| EBS snapshots should be encrypted | Mapped |
Amazon EC2 (11)
Amazon ECR (1)
| Control | Status |
|---|---|
| ECR repositories should have image scan on push enabled | Enforced |
Amazon ECS (1)
| Control | Status |
|---|---|
| ECS services should not have public IP addresses assigned automatically | Enforced |
Amazon EFS (1)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
Amazon EMR (1)
| Control | Status |
|---|---|
| EMR cluster Kerberos should be enabled | Mapped |
Amazon ElastiCache (3)
Amazon Kinesis (3)
Amazon MQ (2)
Amazon MSK (1)
| Control | Status |
|---|---|
| MSK clusters should require TLS for client-broker connections | Enforced |
Amazon Neptune (1)
| Control | Status |
|---|---|
| Neptune DB clusters should be configured to copy tags to snapshots | Mapped |
Amazon OpenSearch Service (2)
Amazon RDS (18)
Amazon Redshift (6)
Amazon S3 (16)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SQS (1)
| Control | Status |
|---|---|
| SQS queues should have a dead-letter queue configured | Mapped |
Amazon SageMaker (3)
Amazon VPC (7)
Elastic Load Balancing (3)
Other (21)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| ISO/IEC 27001:2022 | High 73% | |
| PCI DSS v4.0 | High 69% | |
| NIST Cybersecurity Framework v2.0 | High 67% |
Frequently asked questions
Does SOC 2 apply to my company?
SOC 2 is voluntary. No law requires it. Enterprise customers and their procurement teams, however, often make a SOC 2 Type II report a contract prerequisite for B2B software or services that touch their data. The trigger is customer demand, not regulation.
What is the difference between Type I and Type II?
Type I evaluates whether your controls are properly designed at a single point in time. Type II evaluates both design and operating effectiveness over a period, usually 6 to 12 months. Most enterprise buyers require Type II because it proves controls actually worked, not just that they existed on paper. A Type I can serve as a stepping stone for first-time audits.
How long does it take to get SOC 2 certified?
SOC 2 produces an attestation report, not a certification (a distinction auditors will correct you on). If you have no existing controls, plan for 3 to 6 months to implement them, then 3 to 12 months of operating them for the Type II observation window, then 4 to 8 weeks for the audit itself. Organizations with mature security programs move faster. A Type I can typically be obtained within 2 to 4 months from the start of readiness work.
Which Trust Services Categories should I include?
Security (Common Criteria) is mandatory. The other four (Availability, Processing Integrity, Confidentiality, Privacy) are optional and should reflect your actual customer commitments. SaaS providers typically include Security and Availability at minimum. Add Confidentiality if you handle sensitive data. Privacy is worth including only if you process personal information and want to address it within the SOC 2 scope rather than a separate privacy framework.
How much does a SOC 2 audit cost?
CPA firm fees run from $20,000 to $100,000+ depending on scope, number of Trust Services Categories, company size, and environment complexity. First-year audits cost more because of the readiness assessment phase. Factor in internal costs too: staff time for evidence collection, tooling for continuous monitoring, and remediation work on any gaps found during readiness.