SOC 2 for nonprofits comes down to two different questions. Your own SOC 2 is a licensed CPA firm’s examination report on your organization’s controls. Your vendor’s SOC 2 is the same kind of report on the vendor, and it is the one a nonprofit needs to request and read.
Scottship Solutions helps small to midsize nonprofits tell the two apart and decide what to ask for. Scottship’s fractional CIO work is led by Parker Davis, System Architect.
Not sure which vendor reports your board should see? Cybersecurity services for nonprofits from Scottship can help you sort out which vendors hold your donor data and what each one can prove. Tell us which systems hold your donor, payroll, and HR records.
Does a nonprofit need SOC 2?
Do nonprofits need SOC 2? No law we could find requires a nonprofit to hold a SOC 2 report, and the framework behind it is a standard published by the AICPA. On what we found, SOC 2 compliance for nonprofits is a business decision, not a legal one. For most small to midsize organizations the answer is no, because the report is built for an organization that stores or processes data on behalf of others.
Two situations change that answer. The first is a nonprofit that handles other organizations’ data as a service, such as a fiscal sponsor or a shared-services provider. The second is a signed contract that names SOC 2 as a requirement.
If neither describes you, spend the effort on the vendors instead. Size does not change this, so the same advice holds for any nonprofit.
Your vendors are a different story. The donor database, the payroll provider, and the cloud storage account hold your most sensitive records, and none of them are under your control. A current SOC 2 report is the cleanest evidence that someone independent has looked at how they protect that data. Our cybersecurity guide for nonprofits covers the wider program this review belongs to.
What should a nonprofit ask a vendor that says it has SOC 2?
Ask for the report itself. SOC 2 is an attestation report from a CPA firm, not a certificate, so a badge on a website proves nothing until you read the document behind it. Many vendors share the full SOC 2 report only after you sign a nondisclosure agreement, which is a normal step and not a red flag.
Once the report arrives, work through this list. Each item has a reason.
- The report type: SOC 2 Type 1 describes whether controls are designed properly at a single point in time. SOC 2 Type 2 tests whether those controls operated effectively across an observation period. Type 2 is the stronger evidence.
- The observation period: A Type 2 period that ended long ago tells you little about today’s practices.
- The scope: The AICPA defines five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is always included, and a vendor chooses whether to add the other four, so a report covering only security says nothing about privacy.
- The auditor’s opinion: Look for any exceptions or a qualified opinion. An unqualified opinion with a few noted exceptions is normal, but a qualified opinion on a control that protects your data is a problem.
- Subservice organizations: Many vendors run on another company’s hosting. The report states whether those providers are included or carved out, and a carve-out usually means the report does not test them.
- Complementary user entity controls: These are controls the vendor typically expects you to run yourself, such as removing departed staff from the system. Every one of them is a task on your side.
- The report date and a bridge letter: A bridge letter is typically the vendor’s own statement covering the gap between the report’s end date and today. It is not an audit, but a vendor with a stale report and no bridge letter has not answered the question.
Three red flags deserve a pause before you sign: a narrow scope that leaves out the system holding your data, a stale observation period, and a qualified opinion. None of them ends the conversation automatically. Each one is a question to put back to the vendor in writing.
Which report matters for which nonprofit vendor?
The right report depends on what the vendor does with your data. SOC 1 vs SOC 2 is a question of scope.
A SOC 1 report covers controls relevant to a customer’s financial reporting, which suits payroll and accounting vendors. A SOC 2 report covers security and related criteria, which suits the systems that hold donor and constituent data. For SOC 2 for nonprofit vendors, this table is the starting point.
| Vendor type | Report to ask for | Why |
|---|---|---|
| Donor CRM and email platform | SOC 2, Type 2 where available | These systems hold donor names, giving history, and contact data, which is exactly what the security and confidentiality criteria address. |
| Payroll, accounting, and benefits | SOC 1 for financial controls, plus SOC 2 for data security | These vendors affect your financial statements and also hold employee records, so each report answers a different question. |
| Payment processor | SOC 2, plus the processor’s payment card compliance evidence | Card data follows its own rules, covered in our post on nonprofit cybersecurity compliance frameworks. |
| Cloud storage and collaboration | SOC 2, Type 2 where available | Files, email, and shared drives hold nearly everything else the organization produces. |
What can a nonprofit accept when a vendor has no SOC 2 report?
A small vendor without a report is not automatically a no. A SOC 2 examination is a large expense for a young software company, and many capable vendors have not done one. The tradeoff is plain: when the vendor has no independent report, the risk of trusting it shifts to your nonprofit, and the decision to accept that risk should be recorded and signed off by leadership.
These are the evidence tiers, from strongest to weakest.
| Evidence | What it tells you | Limit |
|---|---|---|
| ISO 27001 certificate with its scope statement | An accredited certification body typically issues it after assessing the vendor’s security management system. | Read the scope statement. A certificate that covers one office and not the product protects your data not at all. SOC 2 vs ISO 27001 is usually a difference in kind: one is a CPA attestation report, the other is a certification. |
| SOC 1 report, where the vendor type fits | An auditor tested the controls behind financial reporting. | It does not cover data security, so it fits payroll and accounting, not a donor database. |
| Completed standard security questionnaire | The vendor answered a recognized set of questions in writing. | The answers are self-reported and not independently tested. |
| Written security policies plus MFA, encryption, and backup answers | The vendor can describe how it protects accounts and data. | Policies on paper are not proof of practice. |
| Independent testing summary | A third party tried to find weaknesses and reported what it found. | It covers a moment in time and a defined target. |
For your own organization’s baseline, the compliance frameworks post linked earlier also points to the NIST Cybersecurity Framework, which gives a nonprofit a way to organize its own controls without any audit.
Frequently Asked Questions
What is SOC 2 and what does it cover?
SOC 2 is an examination report, issued by a licensed CPA firm, on how an organization protects customer data. It is built on the AICPA’s five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is always included and the organization chooses whether to add the others, so the scope section of any report matters as much as the opinion.
Is SOC 2 a certification or an audit report?
SOC 2 is an attestation report from a CPA firm, not a certificate. People search for SOC 2 certification, but what a vendor holds is a report with an opinion. When a vendor shows you a SOC 2 badge, ask to see the report itself.
How much does a SOC 2 audit cost?
Many nonprofits never pay for a SOC 2 of their own, because the vendor holds the report and pays for it. For an organization that does pursue its own, the cost depends on the report type, the scope, and the auditor, and we found no nonprofit-specific price published. Any figure belongs to the CPA firm you ask. Scottship does not perform SOC 2 audits, so it has no price to quote.
Sources and further reading
- AICPA, System and Organization Controls (SOC) suite of services: the AICPA sets the standards for SOC engagements and CPAs provide the assurance reports
- AICPA, SOC 2 reporting on an examination of controls at a service organization: CPAs perform SOC 2 examinations of a service organization’s system and controls
- AICPA, mappings relevant to the SOC suite of services: the five Trust Services Criteria categories
Where does a fractional CIO fit in a SOC 2 review?
A SOC 2 review is a vendor management task, and a fractional CIO or vCIO owns it for a nonprofit with no IT staff. The work is concrete: build the vendor list, request the reports, read them, record the risks the organization accepts, and bring exceptions to leadership. Decisions about who signs off and how the board hears about them belong to leadership, and our post on nonprofit cybersecurity governance covers that side.
Vendor management is part of Scottship’s fractional CIO work, and this review fits inside it. We do not audit for SOC 2 or issue SOC 2 reports. Nonprofits that also want everyday support alongside vendor review can read about managed IT services for nonprofits.
Vendor security review support from Scottship can help your team decide which vendors to accept and which to question. Send us your vendor list and we will walk you through it.
Written by
Parker Davis
System Architect at Scottship Solutions
Parker works hands-on with nonprofit and small business leaders on IT strategy, cybersecurity, AI implementation, and cloud architecture. He leads the work at Scottship Solutions that helps mission-driven organizations build reliable, secure technology infrastructure.
Certifications
IBM AI Product Manager • Lean Six Sigma Yellow Belt • TOGAF Standard • Claude Certified Architect
Industries Served
Human Services, Healthcare & Community Health, Arts & Culture, Education & Youth Development, Faith-Based, Foundations & Grantmakers, Child Advocacy