SOC 2 Type II — controls attestation.
Overview
SOC 2 is an AICPA attestation report on the controls a service organisation operates against the Trust Services Criteria. A Type II report covers how effectively those controls operated over a defined period. BroadNet holds a SOC 2 Type II report.
What the report is
SOC 2 is defined by the American Institute of Certified Public Accountants (AICPA) and produced under the SSAE 18 attestation standard. An independent CPA firm examines the service organisation's controls against one or more Trust Services Criteria — Security (always included), and optionally Availability, Processing Integrity, Confidentiality, and Privacy. A Type I report attests to the design of controls at a single point in time; a Type II report tests operating effectiveness across a period, typically three to twelve months. SOC 2 is an attestation report, not a certification, and is the standard security evidence expected by North American enterprise buyers.
Why it matters to an enterprise buyer
A Type II report is stronger evidence than a point-in-time review because it shows controls worked continuously across the audit window, in the auditor's own words.
- Independent CPA-firm opinion on control effectiveness over time.
- Covers Security and, where in scope, Availability and Confidentiality.
- Directly reusable evidence for your own SOC 2, ISO, or regulatory programs.
- Bridge letters cover the gap between the audit period end and your review date.
BroadNet's status
BroadNet holds a SOC 2 Type II report. The report is shared with enterprise evaluators under NDA. (Note: SOC 2 is separate from PCI DSS, which BroadNet does not hold.)
Scope & validity
The Trust Services Criteria in scope, the audit period, the auditing CPA firm and the report date are stated in the report itself. SOC 2 reports are restricted-use documents and are not published in a public register. Request the current report and, if needed, a bridge letter under NDA at trust@broadnet.me.
Definitions
Trust artefact terminology used on this page is defined below. Acronym choices follow Shared Assessments (SIG) and Cloud Security Alliance (CAIQ) conventions.
- Audit report
- Independent attestation by a qualified auditor over a defined scope and period.
- SIG / CAIQ
- Standard Information Gathering and Consensus Assessments Initiative Questionnaire — completed annually.
- NDA
- Mutual non-disclosure agreement — pre-requisite for receiving non-public audit evidence.
- Evaluator package
- Curated bundle: certificate copies, audit letters, pen-test summary, SIG/CAIQ, and DPA.
Questions?
Need a document under NDA, an evaluator briefing, or evidence for procurement? Our trust team coordinates with security, legal, and finance.
legal@broadnet.me