# SOC 2 Type II — controls attestation.

- Canonical URL: https://www.broadnet.me/trust/soc-2-type-ii
- Language: en
- Publisher: BroadNet (https://www.broadnet.me)
- Markdown version of the page above, generated from the rendered page.

TRUST

Last updated · April 18, 2026 Maintained by · Trust & Compliance Document · /trust/soc-2-type-ii

On this page

Procurement evaluator?

We provide a single evaluator package with the SIG, CAIQ, pen-test summary, and current audit letters.

[Request package](mailto:legal@broadnet.me)

## Overview

SOC 2 is an AICPA attestation report on the controls a service organisation operates against the Trust Services Criteria. A Type II report covers how effectively those controls operated over a defined period. BroadNet holds a SOC 2 Type II report.

§01

## What the report is

SOC 2 is defined by the American Institute of Certified Public Accountants (AICPA) and produced under the SSAE 18 attestation standard. An independent CPA firm examines the service organisation's controls against one or more Trust Services Criteria — Security (always included), and optionally Availability, Processing Integrity, Confidentiality, and Privacy. A Type I report attests to the design of controls at a single point in time; a Type II report tests operating effectiveness across a period, typically three to twelve months. SOC 2 is an attestation report, not a certification, and is the standard security evidence expected by North American enterprise buyers.

§02

## Why it matters to an enterprise buyer

A Type II report is stronger evidence than a point-in-time review because it shows controls worked continuously across the audit window, in the auditor's own words.

- Independent CPA-firm opinion on control effectiveness over time.
- Covers Security and, where in scope, Availability and Confidentiality.
- Directly reusable evidence for your own SOC 2, ISO, or regulatory programs.
- Bridge letters cover the gap between the audit period end and your review date.

§03

## BroadNet's status

BroadNet holds a SOC 2 Type II report. The report is shared with enterprise evaluators under NDA. (Note: SOC 2 is separate from PCI DSS, which BroadNet does not hold.)

§04

## Scope & validity

The Trust Services Criteria in scope, the audit period, the auditing CPA firm and the report date are stated in the report itself. SOC 2 reports are restricted-use documents and are not published in a public register. Request the current report and, if needed, a bridge letter under NDA at trust@broadnet.me.

§05

## Definitions

Trust artefact terminology used on this page is defined below. Acronym choices follow Shared Assessments (SIG) and Cloud Security Alliance (CAIQ) conventions.

Quick reference

**Audit report**

Independent attestation by a qualified auditor over a defined scope and period.

**SIG / CAIQ**

Standard Information Gathering and Consensus Assessments Initiative Questionnaire — completed annually.

**NDA**

Mutual non-disclosure agreement — pre-requisite for receiving non-public audit evidence.

**Evaluator package**

Curated bundle: certificate copies, audit letters, pen-test summary, SIG/CAIQ, and DPA.

## Questions?

Need a document under NDA, an evaluator briefing, or evidence for procurement? Our trust team coordinates with security, legal, and finance.

[legal@broadnet.me](mailto:legal@broadnet.me)

We reply within one business day

Related documents

## Continue reading

[Trust center home](https://www.broadnet.me/trust)

[Document SOC 2 compliance program](https://www.broadnet.me/compliance/soc2) [Document ISO 27001](https://www.broadnet.me/trust/iso-27001) [Document Security overview](https://www.broadnet.me/security) [Document Audit reports](https://www.broadnet.me/trust/audit-reports)