Glossary entry · ai term
SOC 2
Audit framework attesting that a service organization's controls meet criteria for security, availability, processing integrity, confidentiality, and privacy.
Why it matters in tax practice
AI vendors handling taxpayer return information must meet §7216 consent requirements and IRS Publication 4557 / FTC Safeguards Rule security expectations. A SOC 2 Type II attestation is the practical signal that the vendor's controls have been independently audited. Type I = point-in-time; Type II = period-of-time (typically 6+ months). Practitioner vendor due-diligence: SOC 2 + §7216 consent template + DPA are the three minimum artifacts.
Articles using this term