Observation window
The period a Type 2 examination covers to test whether controls operated effectively—not only whether they were designed. Related guide →
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
Reference
SOC 2 glossary
TL;DR. Canonical short definitions for observation window, Type 1/Type 2, TSC, questionnaires, and related founder terms. Educational only.
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
SOC 2 Type 1
A point-in-time examination of the design of controls relevant to selected Trust Services Criteria. Related guide →
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
SOC 2 Type 2
An examination of design and operating effectiveness of controls over an observation window. Related guide →
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
Trust Services Criteria (TSC)
AICPA criteria used in SOC 2 examinations: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Related guide →
Sources: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)
Common Criteria (Security)
The Security category of the Trust Services Criteria—often the scope of a first SOC 2 report. Related guide →
Sources: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)
Auditor engagement letter
The contract that locks examination scope, period, fees, and responsibilities before fieldwork. Related guide →
Sources: SOC 2 — SOC for Service Organizations: Trust Services Criteria
Evidence pack
The curated set of policies, tickets, screenshots, and logs that show controls existed and operated for the examiner. Related guide →
Sources: ProofWindow educational planning ranges
CAIQ
Cloud Security Alliance Consensus Assessments Initiative Questionnaire—yes/no questions mapped to the Cloud Controls Matrix. Related guide →
Sources: What is CAIQ?; STAR Level 1: Security Questionnaire (CAIQ v4.1)
CAIQ Lite
A streamlined CAIQ/CCM path oriented to SMEs and startups (see CSA STAR materials). Related guide →
Sources: CSA STAR
SIG Lite
Shared Assessments Standardized Information Gathering Lite template—commonly used for lower-risk or preliminary vendor questionnaires. Related guide →
Sources: Shared Assessments (SIG)
Control owner
The named person accountable for operating a control and producing its evidence on cadence. Related guide →
Sources: ProofWindow educational planning ranges
Deal-triggered start
Beginning a SOC 2 program when a named deal, RFP, or recurring questionnaire makes the report load-bearing—not before. Related guide →
Sources: ProofWindow educational planning ranges