In a SOC 2 audit, an organization's internal controls are evaluated against the five _____ Services Criteria established by the AICPA.

### Why this is right The course material describes System and Organization Controls 2 (SOC 2) as focusing on security by default. It identifies five Trust Services Criteria and describes internal controls, audits, and documented policies as parts of the examination process. ### The concept SOC 2 is an assurance examination framework associated with the American Institute of Certified Public Accountants. It is used to examine controls relevant to customer-data services and can help a service organization demonstrate its approach to data protection. It is not a law that automatically applies to every organization. ### Terms - **System and Organization Controls 2 (SOC 2)**: An assurance examination framework for controls relevant to service organizations. - **Trust Services Criteria**: Criteria used in SOC 2 examinations to assess controls. - **Assurance examination**: An evaluation of controls or information against defined criteria. ### Remember SOC 2 is an examination framework, not a sector-wide law.