When an MSP says they're SOC 2 certified, most clients nod and move on. But what does it actually mean — and more importantly, what does it mean for you?
What SOC 2 is (and isn't)
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the AICPA. It evaluates whether a service organization's controls meet the Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
There are two types. SOC 2 Type I is a point-in-time assessment — it says controls existed on a given date. SOC 2 Type II is harder to achieve: it covers a period of 6–12 months and tests whether those controls actually worked consistently over time. Type II is the one that matters.
Why your MSP's SOC 2 posture affects you
Your MSP has privileged access to your environment — admin accounts, backup systems, remote monitoring tools. If their house isn't in order, yours isn't either. A SOC 2 Type II certified MSP has been independently audited on how they manage that access, how they respond to incidents, and how they protect your data.
For organizations in regulated industries — healthcare, finance, municipal, professional services — this matters directly. Many frameworks and contracts now require that service providers demonstrate a baseline of security controls. An MSP with a clean SOC 2 Type II opinion gives you evidence to show your own auditors.
The five Trust Service Criteria: what to look for
- Security — logical and physical access controls, encryption, monitoring
- Availability — uptime commitments, disaster recovery, redundancy
- Processing Integrity — accurate, complete, and timely processing
- Confidentiality — protection of information designated as confidential
- Privacy — collection, use, and disposal of personal information
Not every MSP includes all five in their scope. Security is always required. Ask specifically which criteria are in scope and whether you can see the summary of the auditor's opinion.
What to ask before trusting an MSP with your environment
- Do you have a SOC 2 Type II report — not just Type I?
- Which Trust Service Criteria are in scope?
- When was the last audit period, and can we see the opinion letter?
- How do you manage privileged access to client environments?
- What is your incident response process and notification timeline?
- Where is client data stored, and does it leave Canada?
A reputable MSP should be able to answer every one of these questions clearly. Vague answers — or resistance to sharing the report summary — are a red flag.
How Aegisys approaches SOC 2
Aegisys Cloud Solutions holds a SOC 2 Type II certification across our managed IT, cloud hosting, and cybersecurity operations. Our Sudbury-based data centres are included in scope, and all client data remains in Canada. We make our audit posture available to clients and prospects on request.
If you're evaluating MSPs or want to understand how SOC 2 applies to your organization, we're happy to walk through it with you — no sales pitch required.
From the Aegisys team
Questions about this topic? We're happy to talk through your specific situation.
No pitch, no pressure. A straightforward conversation about your environment and what matters most.
Get in touch