SOC 2 Type II

Overview

SOC 2 Type II is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It evaluates an organization's information systems against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. A Type II report covers an extended observation period of 6 to 12 months, verifying that controls are not only properly designed but also operating effectively over time. CodeMiners maintains an active SOC 2 Type II certification, with controls independently verified by a licensed CPA firm.

Governing Body

American Institute of Certified Public Accountants (AICPA)

Scope of Certification

Evaluates the design and operating effectiveness of controls related to security, availability, processing integrity, confidentiality, and privacy of data processed by the service organization.

Audit and Assessment Process

An independent CPA firm conducts the examination. The audit spans 6 to 12 months and includes control testing, evidence sampling, and management assertion review. The resulting report details control objectives, testing procedures, and auditor findings.

Key Requirements

1. Logical and physical access controls
2. System operations monitoring and alerting
3. Change management procedures
4. Risk assessment and mitigation processes
5. Incident response and escalation protocols
6. Data encryption in transit and at rest
7. Vendor and sub-service organization management

Compliance Entitlements

• Third-party verified operational security controls
• Prerequisite for most enterprise procurement evaluations
• Coverage across security, availability, and confidentiality trust services
• Evidence of sustained compliance over the full audit period

Client Benefits

• Provides independently verified assurance that client data is handled securely
• Eliminates the need for clients to conduct their own security audits of CodeMiners
• Satisfies vendor risk management requirements for regulated industries
• Reduces procurement cycle time by providing a ready-made audit artifact

Related Certifications