AICPA’s Service Organization Controls (SOC), both 1 and 2, are sets of criteria that are used to evaluate a company. Depending on how your business operates and the types of services you offer, you can obtain a SOC 1 and/or a SOC 2 report.