Blue Tree Technology®
SCHEDULE YOUR FREE 15-MINUTE DISCOVERY CALLSupport CenterSupport: 816-994-8282Sales: 816-256-2595

What Is SOC 2? A Plain-English Guide for Kansas City Businesses

SOC 2 is an independent report, written by a CPA firm, on how well a company protects the customer data it holds. It matters most when a business stores or processes your data on systems it runs. Blue Tree Technology® is a Kansas City managed IT and cybersecurity company, and we do not have a SOC 2 report. We don't host or store our clients' business data in systems we operate, so we're not pursuing one. We're in the process of earning the GTIA Cybersecurity Trustmark, an independent third-party assessment built for IT service providers, and we help our clients get ready for their own SOC 2, HIPAA and PCI DSS work. We help you prepare; we don't do the audit.

See our IT support for small businesses in Kansas City.

Schedule a Free 15-Minute Discovery Call

Sales 816-256-2595

What is SOC 2?

SOC stands for System and Organization Controls. It's a set of reporting standards from the AICPA, the American Institute of CPAs. The AICPA describes a SOC 2 examination as "a report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy."

In plain words: a SOC 2 report tells your customers what you do to protect their information, and an independent CPA firm gives an opinion on whether you actually do it.

A few terms help:

  • Service organization. A company that provides a service to other businesses and, in doing so, holds or processes their data. Think hosting, software platforms, payroll or billing processors.
  • Trust Services Criteria. The yardstick the CPA firm uses. There are five categories:
    • Security. Systems and information are protected against unauthorized access and damage.
    • Availability. Systems are available for operation and use as promised.
    • Processing integrity. System processing is complete, valid, accurate, timely and authorized.
    • Confidentiality. Information designated as confidential is protected.
    • Privacy. Personal information is collected, used, retained, disclosed and disposed of as promised.
  • Scope. Security is the base. A company chooses which of the other four to add, depending on the service it provides.
  • Service auditor. The independent CPA firm that performs the examination and issues the report.

SOC 2 is a report with a CPA's opinion, not a certificate you hang on the wall. No company can "give itself" SOC 2 and no IT provider can make you "SOC 2 compliant" by installing tools.

SOC 2 Type I vs. Type II

There are two kinds of SOC 2 report.

Swipe sideways to compare Type I and Type II.

SOC 2 Type I compared with Type II
Type I Type II
What the CPA looks at Whether the controls are suitably designed Whether the controls are suitably designed and operated effectively
Time frame A single point in time A period of time
What you get A CPA's opinion on the system description and control design The same, plus an opinion on how the controls operated, and a description of the CPA's tests and results

Type I answers "is the plan sound today?" Type II answers "did the plan work over time?" Because Type II includes the CPA firm's testing over a period, it tells you more than Type I. Ask any provider that mentions SOC 2 which type they hold, which period it covers and which CPA firm issued it.

Who actually needs a SOC 2 report?

SOC 2 is built for service organizations: companies that hold or process other businesses' data on systems they operate. If you run a software platform, hosting service, payment or payroll processor, or any service where customers' data lives in your environment, your customers may ask for a SOC 2 report.

Most other small businesses don't get a SOC 2 report of their own. They're the ones asking for one, or asking a different question.

What about a financial advisory firm?

An advisory firm is usually a customer of service organizations, not one itself. Its legal duties come from financial regulators, and those rules don't name SOC 2:

  • SEC Regulation S-P applies to SEC-registered investment advisers, broker-dealers and investment companies. The 2024 amendments require a written incident response program, customer notice within 30 days after becoming aware of unauthorized access, and oversight of service providers, including due diligence and monitoring. A covered firm must make sure its service providers notify it as soon as possible, and no later than 72 hours, after a breach affecting a customer information system they maintain. The SEC set compliance dates of December 3, 2025 for larger entities and June 3, 2026 for smaller entities.
  • The FTC Safeguards Rule covers financial institutions under FTC jurisdiction. The FTC lists "investment advisors that aren't required to register with the SEC" among them. It requires a written information security program and says covered companies must take steps to ensure their service providers safeguard customer information. Among its elements are multi-factor authentication, access controls, encryption, staff training, a written incident response plan and service-provider monitoring.
  • FINRA oversees broker-dealers. Its small-firm guidance says firms should review SOC or SSAE 18 reports for third-party vendors with access to confidential firm and customer data, and that contracts should include provisions to enforce controls and require prompt notice of breaches.

So the honest answer for a financial advisory firm is: no rule says "get a SOC 2 report." The rules say protect customer information, write it down, and oversee your vendors. A vendor's SOC 2 report is one common way to show the vendor was checked. It isn't the only way. Which rules apply to your firm depends on how it's registered, so confirm that with your compliance consultant or attorney.

See IT support for financial firms in Kansas City.

What SOC 2 means when you choose an IT provider

When you hire an IT provider, you're hiring a vendor with access to your systems. Your regulators, your insurer and your own clients may expect you to have vetted that vendor. A SOC 2 report is one way a vendor can show it's been independently tested. It's useful, but it doesn't tell you everything. Ask these questions of any IT provider, including us:

  1. Do you hold a SOC 2 report? If yes: Type I or Type II? What period does it cover? Which CPA firm issued it? Can I read the whole report, including exceptions?
  2. Is your scope the same as my risk? A report covers only the systems and services named in it. Check that it covers the services you'd use.
  3. If you don't hold one, what independent assurance do you have instead? Ask who assessed it, against what standard, and what its current status is.
  4. What access will you have to my systems and data? Administrative access, remote tools, stored copies, backups. Ask where each lives.
  5. How fast will you tell me about a breach on your side? Regulators such as the SEC set outer limits for covered firms. Get the number of hours into the contract.
  6. What evidence can you give me? Ask which records you'll receive and how often: patch and endpoint reports, MFA coverage, asset inventory, access reviews, training and phishing results, policies. Ask whether backups are monitored and verifiable, not just "turned on."
  7. Who does what? Ask which controls you'll operate, which controls they'll operate, and which stay with you.

Our free IT Buyer's Guide (21 questions to ask any IT provider).

Where Blue Tree stands

Here is the plain version.

See our IT support for small businesses in Kansas City.

We don't have a SOC 2 report and we're not pursuing one. SOC 2 is designed for companies that hold their customers' data in systems they run. We don't host or store our clients' business data in systems we operate, so that kind of report doesn't fit what we do.

That doesn't put us outside your vendor review. We do have administrative access to the systems we manage, and our plans include backup of Microsoft 365 and Google Workspace. Those backups are kept with a third-party provider, and we can request that provider's SOC report for clients. We monitor those backups so they're verifiable. If you're subject to Regulation S-P, the FTC Safeguards Rule or FINRA guidance, you should vet us the same way you'd vet any vendor with access, and we'll help you do it.

We're in the process of earning the GTIA Cybersecurity Trustmark. We haven't earned it yet. When we do, we'll say so here and show GTIA's status, not just a logo.

What is the GTIA Cybersecurity Trustmark?

GTIA (the Global Technology Industry Association) is the nonprofit trade association for the IT channel, and the Trustmark is its program for IT service providers. In GTIA's words, it is "foundationally based on the Center for Internet Security's 18 Critical Security Controls IG2, and supplemented by controls from other globally recognized frameworks," and it "identifies industry-accepted best practices unique to IT service providers." GTIA calls it "an assurance," not a framework.

How it works, per GTIA:

  • It's independently assessed. GTIA's FAQ says the Trustmark "is also independently assessed and verified." GTIA says that when a member is ready, "a CREST accredited assessor will be made available through GTIA." In April 2025 GTIA said it was using CREST-accredited VerSprite as its independent third-party assessor.
  • It's not one-and-done. GTIA says "there is no time at which the 'box is checked' and the job is done," and its own blog says companies that earn it "will be audited annually."
  • It's built on the CIS Controls. GTIA's FAQ says the Trustmark has 18 controls and 177 safeguards, about 123 of which come from the 153 CIS safeguards, with others drawn from HIPAA, NIST SP 800-171, NIST 800-53, NYDFS and ISO 27001.
  • It shows its status. GTIA says participants get a badge showing their stage: "In Progress, Provisional and Assured."

Why this fits an MSP better than SOC 2

SOC 2 asks whether a company protects the customer data it holds. For an IT provider, the bigger question is different: do you run your own security the way you tell clients to run theirs? GTIA built the Trustmark around that question, noting that "for decades, frameworks designed for other businesses—facing different risk landscapes—have been attempted to fit the scope of the ITSP." The CIS Critical Security Controls cover the things an IT provider actually does, like asset inventory, access control, patching, logging, malware defense, backup and recovery, and incident response. It's the same approach we take with our clients: prove it, don't just claim it.

One caution: the Trustmark and SOC 2 are different things. The Trustmark is not a SOC 2 report, doesn't replace one, and we won't describe it as one. If a client needs a vendor SOC 2 report specifically, we'll tell you plainly that we don't have one.

How Blue Tree helps you get ready for SOC 2, HIPAA and PCI DSS

If your business does need a SOC 2 report, or you're answering vendor questionnaires from customers, here is where we fit. That work sits in our IT compliance services and cybersecurity services.

What we do

  • Put the technical controls in place and keep them running. Multi-factor authentication, endpoint detection and response, patching, email filtering, monitored backup and a managed firewall. These are part of our managed IT and cybersecurity services.
  • Collect the evidence our work produces. On request, we can supply patch and endpoint coverage reports, MFA coverage, asset inventory, access reviews, training and phishing-test results, and policies. See What IT evidence can your firm provide to an auditor, regulator, or insurer?
  • Run gap assessments and write policies. We assess your environment, compare it against the framework you're working toward, and put the fixes in a plan. We also write the policies that go with it.
  • Work with your CPA firm. We work with your auditor and answer their IT questions about the systems we manage, within our scope.

What we don't do

  • We don't perform the audit or issue the report. Only an independent CPA firm can do that. The AICPA's own materials describe the CPA-led "readiness assessment" and the examination as CPA work. If a provider says it will "give" you SOC 2, ask who the CPA firm is.
  • We don't sign statements about controls we can't verify. We provide evidence about work within our scope. We won't tell an auditor, regulator or insurer that your whole company is compliant.
  • We don't promise an outcome. An auditor's opinion, a regulator's view and an insurer's decision are theirs.

How it usually goes

  1. Free 15-minute call. We learn what you're being asked for and by whom: a client, a regulator, an insurer, or your own board. Free 15-minute discovery call.
  2. Assessment. We look at your current environment against what's being asked.
  3. Plan. You get a plain list of gaps, owners and order of work.
  4. Operate and document. We run the controls and keep the records current, so evidence exists before the audit begins.
  5. Support the audit. Your CPA firm or compliance consultant performs the audit or review. We work alongside you and your auditor, answering IT questions and supplying evidence, within our scope.

FAQ

What is SOC 2 in simple terms?

SOC 2 is a report from an independent CPA firm on how a company protects the customer data it holds. It's measured against the AICPA's five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.

Is SOC 2 a certification?

No. It's a report that contains a CPA's opinion. Some people call it a certification, but a CPA firm issues an opinion, not a certificate. When a company says it has SOC 2, ask which type, which period and which CPA firm.

Does my Kansas City financial advisory firm need SOC 2?

Usually your firm isn't the one that needs a SOC 2 report. SEC Regulation S-P, the FTC Safeguards Rule and FINRA's small-firm guidance ask your firm to protect customer information and to oversee its service providers. They don't set SOC 2 as the required method. Which rules apply depends on how your firm is registered, so check with your compliance consultant or attorney.

Does Blue Tree Technology® have a SOC 2 report?

No. We don't host or store our clients' business data in systems we operate, so we're not pursuing our own SOC 2 report. Backups are kept with a third-party provider, and we can request that provider's SOC report for clients. We're in the process of earning the GTIA Cybersecurity Trustmark, an independent third-party assessment built on the CIS Critical Security Controls.

What is the GTIA Cybersecurity Trustmark?

It's an assurance program from GTIA, the technology industry trade association, for IT service providers. GTIA describes it as "foundationally based on the Center for Internet Security's 18 Critical Security Controls IG2." A CREST-accredited third-party assessor does the assessment, and companies that earn it are assessed again each year.

Can Blue Tree make my business SOC 2 compliant?

We can help you get ready for SOC 2, HIPAA or PCI DSS. We put the technical controls in place and keep them running, collect the evidence our work produces, run gap assessments, write policies and work with your auditor. We don't do the audit. The audit and the report come from your CPA firm.

What should I ask an IT provider about security?

Ask whether it holds a SOC 2 report, and if not, what independent assurance it has instead. Ask what access it will have to your systems, how fast it will tell you about a breach, and which evidence it will provide. See the seven questions above.

Ready to talk it through?

If a customer, regulator or insurer is asking about SOC 2, bring us the request. In 15 minutes we'll tell you what's actually being asked, whether you need a SOC 2 report or something else, and where we can help. We'll say so if we're not the right fit.

For IT support for financial firms in Kansas City, start with the same call.

Schedule a free 15-minute discovery call

Sales 816-256-2595 · 1827 NW Vivion Road, Riverside, MO 64150

Blue Tree Technology® is a women- and minority-owned managed IT and cybersecurity company in Riverside, Missouri, supporting small businesses across the Kansas City metro, St. Joseph and Topeka. We've been supporting Kansas City businesses since 2001. 300+ businesses served since 2001, about 70 on managed service agreements today.

This page is general information, not legal, audit or compliance advice. Your CPA firm, compliance consultant or attorney should confirm which requirements apply to your business.

Sources