Why "Do You Have a SOC 2 Report?" Is Now a Standard Procurement Question

SOC 2 is not a government regulation or a legal requirement. It's a voluntary attestation framework developed by the American Institute of Certified Public Accountants (AICPA). It is built around five Trust Services Criteria: • Security • Availability • Processing Integrity • Confidentiality • Privacy Security is the only mandatory category; a vendor can scope its audit to include or exclude the other four depending on what its service actually does. A SOC 2 report isn't a certificate a company earns once — it's the output of an independent CPA firm examining a vendor's actual controls and issuing a formal opinion. There are two types: • Type I: Assesses whether controls are properly designed at a single point in time. • Type II: Goes further, testing whether those controls operated effectively over a sustained period, typically three to twelve months. For institutions doing serious due diligence, Type II is the more meaningful signal, because it shows sustained practice.

Plagiarism and AI-detection platforms sit in an unusual position. They need broad access to student work, including unpublished theses, dissertations, and research papers, in order to function at all. That makes vendor security posture a direct extension of institutional risk. According to IBM's 2025 Cost of a Data Breach Report, the education sector continues to face rising exposure to ransomware and credential-based attacks targeting student records and login systems. Every institution's exposure now includes every vendor it shares data with. This is exactly why, when evaluating an academic integrity platform, a SOC 2 report should be treated less as a compliance formality and more as a due-diligence document worth actually reading. It tells procurement teams where a vendor's controls have gaps and how incidents are detected and escalated. It also shows whether the vendor reviews the security posture of its own subprocessors, a control often labelled CC9.2 in SOC 2 reports. Auditors have been enforcing this more consistently as vendor supply chains have become longer and harder to trace.

GDPR — Is It Legally Compliant? • GDPR is a legal requirement for organisations processing EU personal data. • It focuses on how personal data is collected, processed, stored, and protected. ISO 27001 — Does It Have a Certified Security Management System? • ISO 27001 is an international information security standard. • Organisations are audited against its requirements to achieve certification. • It focuses on the organisation's overall information security management system (ISMS). SOC 2 — Do the Vendor's Controls Work in Practice? • SOC 2 is an independent attestation of a service organisation's controls. • Auditors test those controls against AICPA criteria. • It provides evidence of how effectively a vendor's specific security controls operate.

It's worth correcting a common misconception here: the AICPA has not issued a new version of the Trust Services Criteria for 2025 or 2026. The framework currently in force is still the 2017 Trust Services Criteria, with revised points of focus published in 2022. What has changed is not the rulebook. Instead, auditors and procurement teams are applying greater scrutiny to several areas. These include subservice-provider evidence, access controls, and network segmentation. There is also growing alignment between SOC 2's Security criteria and frameworks such as the NIST Cybersecurity Framework. This is particularly relevant as U.S. state-level student data laws, such as Illinois' SOPPA and New York's Education Law 2-d, increasingly reference NIST alignment. In practice, a SOC 2 report that seemed sufficient three years ago may now face more detailed questions from security-conscious institutions.

• Ask for Type II: Sustained operating effectiveness matters more than a design snapshot. • Read the scope, not just the cover page: Confirm which of the five Trust Services Criteria are actually included; "Security only" is common and worth knowing. • Check the observation period and exceptions: Every SOC 2 report lists any control exceptions found during the audit; a vendor with none isn't necessarily safer than one that discloses and remediates them. • Ask how subprocessors are vetted: This is particularly relevant for cloud-hosted plagiarism and AI content detection tools that may rely on third-party infrastructure. • Pair it with a documented data processing agreement: A SOC 2 report demonstrates security controls; it doesn't replace the contractual GDPR or FERPA obligations a vendor still needs to meet separately. DrillBit describes its platform as SOC 2 aligned, with encryption applied to data both at rest and in transit. These should be considered standard security measures for institutions evaluating academic integrity tools, rather than differentiators. Not "Do you have a SOC 2 report?" but "What does the report actually say?" The more important question is one procurement teams are increasingly asking: not "Do you have a SOC 2 report?" but "What does the report actually say?"

• AICPA's official SOC 2 overview — the primary source defining SOC 2 and the Trust Services Criteria: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2 • AICPA Trust Services Criteria (TSP Section 100) — the authoritative criteria document referenced in every SOC 2 audit: https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022 • IAPP's analysis of ISO and SOC 2 credentials for GDPR compliance — a privacy-industry body's guidance on how these frameworks intersect: https://iapp.org/news/a/understanding-data-processors-iso-and-soc-2-credentials-for-gdpr-compliance • NIST Cybersecurity Framework — the U.S. government framework increasingly referenced alongside SOC 2 in state student-data laws: https://www.nist.gov/cyberframework • IBM Cost of a Data Breach Report — independent annual data on breach costs and sector-specific risk, including education: https://www.ibm.com/reports/data-breach