## SOC 2 Compliance

**SOC 2 (Service Organization Control 2)** is the gold standard for SaaS companies.

### The Trust Services Criteria (TSC)
1.  **Security** (Mandatory): Firewalls, IDS, MFA.
2.  **Availability**: Uptime, DR.
3.  **Processing Integrity**: Data is accurate.
4.  **Confidentiality**: Encryption.
5.  **Privacy**: Consents.

### Type 1 vs Type 2
*   **Type 1**: "Design". A snapshot in time. "On Jan 1st, they had a firewall."
*   **Type 2**: "Operating Effectiveness". Observation over 6-12 months. "For the entire year, they kept the firewall running and reviewed logs daily."
*   *Note*: Enterprise customers demand SOC 2 Type 2 reports.

### The Analyst's Role
Evidence Collection.
*   Auditor: "Prove you review access logs."
*   Analyst: "Here is the ticket #1234 where I reviewed the logs."