SOC 2 is a reporting format and not a security framework. The AICPA’s Trust Services Criteria is aligned to the HITRUST CSF that provides standard and equivalent requirements for SOC 2 reporting. Organizations can issue a SOC 2 report on HITRUST CSF control requirements and them as the basis of their cybersecurity program.