What Is SOC 2 Scope?

Your SOC 2 scope defines the boundaries of the system your report covers — the specific services, infrastructure, people, and processes the auditor will evaluate. Everything inside scope is audited. Everything outside scope is not covered by the report. Your system description (a required document in every SOC 2 report) defines this boundary for readers.

What Always Goes In Scope

Any AWS service or system that stores, processes, or transmits customer data relevant to your trust service criteria must be in scope. For a typical SaaS product this means: your production AWS account, the services that run your application (ECS/EKS/Lambda, RDS, S3), your CI/CD pipeline (because change management controls live there), your identity provider (if it controls access to production), and your customer support tools if they have access to customer data.

What You Can Legitimately Exclude

Development and staging environments can often be excluded if they don't process real customer data. Internal tools that don't touch customer data are excludable. Pre-production AWS accounts with no customer data access are excludable. The key test: if a control in this system failed, would it create a risk to the data or availability commitments covered by your trust service criteria? If no, it can likely be excluded.

Which Trust Service Criteria to Include

Start with Security — it's mandatory. Add Availability if you have uptime commitments to customers. Add Confidentiality if your product handles commercially sensitive data. Add Processing Integrity if your product makes financial calculations or processes orders. Add Privacy if you handle significant personal data. Most B2B SaaS companies start with Security + Availability and add criteria as their customer base grows.

How Scope Affects Audit Cost

Audit fees are directly correlated to scope complexity. Every additional AWS account, service category, or trust service criterion adds audit hours. For a first audit, narrow scope intelligently: the production AWS account, the two or three core services your product runs on, and Security + Availability. Expand scope in subsequent audits as your environment matures.

Important: Don't exclude systems you're embarrassed about or that have known gaps. Auditors understand context. A scope that excludes systems your customers care about will be questioned by sophisticated security reviewers who read your system description carefully.