An auditing framework developed by the AICPA (American Institute of Certified Public Accountants) that evaluates a service organization's controls across five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. SOC 2 reports are commonly required by enterprise customers to verify that vendors properly protect customer data.