SOC 2 news from Infosec Standards https://infosecstandards.org/standards/soc-2 News about SOC 2, including major updates to our page on it. en-us Standard pages now say who decides your obligation, and what to ask them https://infosecstandards.org/news/who-decides-what-to-ask https://infosecstandards.org/news/who-decides-what-to-ask Thu, 03 Sep 2026 00:00:00 GMT The HIPAA, PCI DSS, CMMC, and SOC 2 pages each gained a section naming the party that actually sets your obligation and the questions to put to them in writing. HIPAA and SOC 2 also gained a first-decision picker. Infosec Standards now has a free, browser-only risk assessment tool https://infosecstandards.org/news/risk-assessment-tool https://infosecstandards.org/news/risk-assessment-tool Wed, 02 Sep 2026 00:00:00 GMT Infosec Standards now has a guided, NIST SP 800-30 based risk assessment tool. Everything stays in your browser; you leave with a JSON file to resume from, a spreadsheet register, and a printable report. SOC 2 Trust Services Criteria points of focus revised in 2022 https://infosecstandards.org/news/soc-2-2022-points-of-focus https://infosecstandards.org/news/soc-2-2022-points-of-focus Sat, 01 Oct 2022 00:00:00 GMT In October 2022, AICPA revised the points of focus that support the 2017 Trust Services Criteria. The criteria themselves did not change. This remains the current SOC 2 basis.