What each claim proves
| Claim | What it usually means | Independent proof? |
|---|---|---|
| “SOC 2 compliant” / “SOC 2 practices” | The company says it follows controls aligned with SOC 2 | No report |
| “SOC 2 ready” | Preparing for an audit, or helps clients prepare | No report |
| SOC 2 Type I | An auditor confirmed controls were designed properly on one date | Yes — a point in time |
| SOC 2 Type II | An auditor tested that controls operated effectively over months | Yes — over time |
Why your MSP’s own SOC 2 matters more than most vendors’
An IT provider isn’t just another vendor. It holds administrator access to your email, files, firewalls and backups — often through remote-management tools that reach every computer you own. Attackers know this: compromising one MSP can open the door to all of its clients. That’s why the question isn’t whether your provider helps clients with SOC 2 — it’s whether its own controls have been independently tested.
The wording you’ll see on MSP websites
We reviewed the websites of 20 other managed IT providers serving Orange County in October 2026. Here are the phrases we found, and what each one tells you:
| What the website says | What it tells you | What to ask |
|---|---|---|
| “SOC 2 compliant practices” | They describe their own practices. No auditor is named. | “Is there an audit report? Which firm?” |
| “SOC 2 Ready” | Preparing for an audit, or believes it would pass one. | “When will the audit be complete?” |
| “SOC 2 compliant” (no Type) | Could mean a Type I, a Type II or no report at all. | “Type I or Type II? For what period?” |
| “We help you achieve SOC 2” | A consulting service for clients — says nothing about the provider itself. | “Do you have your own report?” |
| “SOC 2 Type II” (scope not stated) | A real audit. It may cover security only. | “Which Trust Services Criteria are in scope?” |
| “SOC 2 Type II, all five Trust Services Criteria” | A full-scope independent audit of controls operating over time. | “May we read it under NDA?” — for ours, yes. |
Of those 20 providers, only three said they hold their own SOC 2 Type II report. Most used one of the first four phrases — or didn’t mention SOC 2 at all. CAL IT Group’s Type II report, audited by A-LIGN, covers all five Trust Services Criteria.
Why the five Trust Services Criteria matter
A SOC 2 report is scoped to one or more Trust Services Criteria: security (required), availability, processing integrity, confidentiality and privacy. Many reports cover security only. CAL IT Group’s SOC 2 Type II, audited by A-LIGN, covers all five.
Six questions to ask any IT provider
- Do you have your own SOC 2 Type II report — not just help for clients?
- Which CPA firm performed the audit?
- What period did it cover, and is there a bridge letter to today?
- Which Trust Services Criteria are in scope?
- Were there exceptions, and how were they resolved?
- Can we read the report under NDA before signing?
Type I, Type II and the bridge letter
A Type I report is a snapshot: on one date, the controls were designed properly. A Type II report covers a period — usually six to twelve months — and tests whether those controls actually worked the whole time. Because any report looks backward, ask for a bridge letter covering the months since the audit period ended, and check that the report is renewed every year.
Read ours
Request the report, sign a standard NDA and we’ll send it — or request access through our online Trust Center, where our security controls, policies and compliance documentation are published.