SOC 2 anchors

Stefan Coetzeecreated 2026-05-12updated 2026-05-121 min readanchors

Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Primary documents

AICPA Trust Services Criteria (2017, revised 2022) — full TSC document.
SSAE 18 — current attestation standard.
AT-C section 105 — concepts common to all attestation engagements.
AT-C section 205 — assertion-based examinations (Type 2).
AICPA SOC 2 Reporting Guide — implementation reference for auditors and service organizations.

Operating bodies

AICPA (American Institute of Certified Public Accountants) — owner of attestation standards.
AICPA Auditing Standards Board (ASB) — develops standards.
State boards of accountancy — regulate CPA practice in US states.

Common audit firms

CPA firms with SOC 2 capability:

Schellman — large SOC 2 + ISO 27001 + ISO 42001 + HITRUST volume.
A-LIGN — similar positioning.
Coalfire — security-specialist CPA firm.
BSI Americas — UK-headquartered, US operations for SOC 2.
Deloitte, KPMG, PwC, EY — Big Four with SOC 2 practices.
BPM, BPM SOC, Many others — regional / mid-market.

Adjacent frameworks

ISO 27001:2022 — international sibling. Combined audits common.
HITRUST CSF — healthcare-broadened US framework.
PCI DSS — payment card industry.
HIPAA Security Rule — US healthcare.
FedRAMP — US federal cloud.
NIST CSF 2.0 — voluntary US framework.

Mapping resources

AICPA TSC mapping to ISO 27001 — available.
TSC mapping to HITRUST — available.
TSC mapping to PCI DSS — available.
Various vendor-published mapping documents.

Reference resources

aicpa-cima.com — AICPA-CIMA combined site; SOC resources.
CPA firm publications — Schellman, A-LIGN, others publish substantial SOC 2 content.
Various SaaS GRC platforms (Drata, Vanta, Secureframe, Tugboat Logic, others) — SOC 2 readiness tooling.