An auditing framework from the AICPA that assesses how a service company protects customer data, based on five trust services criteria.
SOC 2, short for System and Organization Controls 2, was developed by the American Institute of Certified Public Accountants. An independent auditor evaluates a company's controls against trust services criteria: security, availability, processing integrity, confidentiality, and privacy. Security is required, and the others are included as relevant. A Type I report assesses control design at a point in time, while a Type II report tests whether controls operated effectively over a period, often six to twelve months.
Software and cloud providers commonly pursue SOC 2 because business customers ask for it during vendor reviews. For example, a payroll software startup may need a SOC 2 Type II report before a larger company will sign a contract. SOC 2 is not a certification with a pass mark; it is an audit report that customers read and evaluate themselves.
The Health Insurance Portability and Accountability Act, a 1996 US law that sets rules for protecting the privacy and security of health information.
PCI DSSThe Payment Card Industry Data Security Standard, a set of security requirements for any organization that stores, processes, or transmits card data.
Security Operations CenterA team and facility that monitors an organization's systems around the clock to detect, analyze, and respond to cybersecurity threats.
CMMC is now in DoD contracts, and third-party Level 2 assessments start appearing November 10, 2026. Here's what each level requires and the first steps for small suppliers.
A buyer's checklist for AI meeting assistants covering recording consent laws, accuracy testing, integrations, data retention, security and cost.
Every comprehensive US state consumer privacy law in effect or enacted as of October 2026, with effective dates, thresholds, key rights and official sources.