The AICPA is making changes to SOC 2, and most companies aren't paying attention yet.
Here's what's happening and what it means for you.
The attestation standards are being rewritten. The AICPA Auditing Standards Board has been working on revisions to the core attestation standards (AT-C 105, 205, and 210) that govern how SOC 2 examinations are conducted. The exposure drafts closed for comment in June 2026, and the board is now reviewing the 23 responses. No final standard has been issued yet.
The proposed effective date is engagements beginning on or after June 15, 2029. But that doesn't mean you can ignore this until 2029.
What's changing:
Evidence standards are getting stricter. The revised AT-C 205 would align more closely with AU-C 500's evidence principles. Auditors will scrutinize the relevance and reliability of your evidence more carefully, especially information prepared with management specialists. If your evidence collection is sloppy, expect findings.
Risk assessments are getting deeper. Procedures will be scaled to subject matter complexity, with more attention to fraud risk and noncompliance with laws and regulations. The days of copying last year's risk assessment are numbered.
Type II engagements feel it most. Since Type II relies on records gathered over a period, the tighter evidence and risk requirements hit hardest here. Your controls need to work consistently, not just during audit week.
What hasn't changed: The Trust Services Criteria themselves. Still the 2017 criteria with the 2022 revised points of focus. No new criteria have been added.
What auditors are already expecting, even before the new standards:
The criteria haven't changed, but how auditors interpret them has shifted significantly:
Vendor and supply-chain scrutiny is up. 89.6% of SOC 2 reports now reference subservice providers, up from 82% the year before. Expect documented vendor tiering, onboarding processes, and continuous monitoring.
Confidentiality is now included in 64% of reports, up from 34% in 2023. Availability appears in 75%. More companies are adding optional criteria, and more customers are requiring them.
Reports covering 150+ controls jumped from 16% to 23%. Reports are getting bigger, more detailed, and harder to fake.
Cross-framework mapping is becoming standard. SOC 2 controls mapped to HIPAA, ISO 27001, NIST, and HITRUST, including SOC 2+ reports, are increasingly expected.
What you should do now:
- Don't wait for 2029. Auditors are already tightening their approach. The new standards will formalize what the best firms are already doing.
- Clean up your evidence. Automated, continuous evidence collection beats scrambling before an audit. If you're still pulling screenshots into folders, it's time to mature that process.
- Formalize your risk assessment. Make it recurring, documented, and tied to actual business changes. Not a once-a-year checkbox.
- Get your vendor program in order. Collect vendor SOC 2 and ISO reports. Tier your vendors by risk. Document your onboarding and offboarding processes.
- Talk to your auditor. Ask them how they're interpreting the exposure drafts and whether they expect any scope changes for your next examination.
The AICPA doesn't overhaul SOC 2 often. When they do, it's worth paying attention. By the time the standard is final, the market will already expect you to meet it.
Com-Sec manages SOC 2 programs for startups and growth-stage companies, from readiness through audit and beyond. If you need help getting ahead of these changes, visit com-sec.io.