SOC 2+ reports: adding HIPAA, CSA CCM or C5 criteria

Is a SOC 2+ report worth it when a health or cloud customer asks for more than SOC 2?

A customer, contract or regulator now names HIPAA, CSA CCM or C5 alongside SOC 2, and you need to decide whether to extend the examination or answer the request another way. A SOC 2+ report is one independent examination that also addresses added criteria or subject matter. The organization owns and operates its controls, and only the independent CPA firm issues the report. Your job is to decide what the extra scope buys you, and what it will cost in preparation and auditor time, before you agree to it.

Start with the named customer's actual need. Ask the requesting party which criteria, framework or regulatory obligation they must evidence, whether they accept a report that cites those criteria, and whether they will read the full report or only a summary. A health customer asking about HIPAA-related criteria may be relying on its own obligations as a covered entity, and under 45 CFR 164.302 a business associate must meet the Security Rule's standards in its own right. That does not mean a SOC 2 opinion answers HIPAA compliance, so confirm in writing what the customer wants the report to show. Cloud customers asking for CSA CCM or C5 may be satisfied by a report that maps to those controls, which is a different request from a separate attestation.

Then map the extra criteria against the controls you already run. If access reviews, logging, change management, encryption and vendor management already operate with evidence, the marginal work may be a mapping exercise plus added tests. If the added framework requires controls the system does not have, the work becomes a build project with its own timeline and recurring operating cost. Ask your CPA firm to confirm, in its engagement letter, which additional criteria it will test, the period covered, and how it will treat controls that serve more than one framework. Request a written quote that separates the added testing from the base examination so you can compare it with the cost of a separate assessment.

How CSA STAR Attestation and C5 work as worked examples

CSA STAR Attestation is a collaboration between the Cloud Security Alliance and the AICPA. It combines a SOC 2 engagement with the CSA Cloud Controls Matrix (CCM), so the service organization's auditor tests the CCM as well as the Trust Services Criteria. The result is listed as a STAR Level 2 third-party assessment. The CCM is a cloud-specific control catalog, so the examination asks whether the provider's controls address cloud risks that a generic SOC 2 may not name directly.

Two frameworks, one engagement: The SOC 2 opinion and the CCM mapping come from the same examination period and the same system, so customers do not commission two separate audits.
Registry listing: The STAR registry entry is what buyers search for. Listings expire after one year unless they are updated, so an old entry is not evidence of current status.
Version matters: Ask which CCM version the report covers. Microsoft's Azure report, for example, addresses CCM v4, and a later CCM version may require different evidence.
Level distinction: STAR Level 2 is a third-party assessment. A self-assessment at Level 1 is a different document with different assurance, and should not be presented as equivalent.
Scope of the listing: The listing covers the services named in the examination. A product line that was not in scope is not covered by the STAR entry.

Before relying on a STAR Attestation, confirm the period, the services in scope, the CCM version and the registry date, then read the carve-outs for any subservice organizations the provider uses.

Adding HIPAA-related criteria for health customers

HIPAA has no SOC 2 criteria set of its own, so a health customer asking for SOC 2 evidence usually wants one of two things: a SOC 2 report whose controls are mapped to the HIPAA Security Rule safeguards, or a HITRUST assessment that a customer can read against HIPAA. These are different instruments. A SOC 2 is an attestation by an independent CPA firm over the controls you describe, while the HIPAA Security Rule is a regulation that applies to covered entities and business associates whether or not any report exists. Before you agree to add HIPAA language to a SOC 2 scope, ask the customer which of these two outcomes their contract or risk team actually needs, and whether they accept a mapping prepared by you or expect the CPA firm to address it.

If you handle electronic protected health information for a covered entity, you are a business associate, and the Security Rule's standards and implementation specifications in 45 CFR 164.302 apply to you directly. The HHS fact sheet on the direct liability of business associates explains that the Office for Civil Rights can take enforcement action against you for Security Rule failures, not only through the customer's business associate agreement. A SOC 2 report does not discharge that duty. It is evidence a customer can use in its own due diligence, so the reader should confirm with counsel which Security Rule safeguards their existing controls address and which gaps remain, such as documented risk analysis or contingency planning.

HITRUST publishes resources on applying SOC 2 work toward an e1 assessment, and its guidance on HITRUST vs SOC 2 describes how the two assurance mechanisms differ in scope and structure. Confirm the current requirements for any HITRUST assessment directly with HITRUST and with an external assessor before budgeting, since the assessment type, validation and assessor eligibility are set by HITRUST. Separately, HHS published a proposed update to the HIPAA Security Rule in the Federal Register on January 6, 2025 (90 FR 898). That proposal is pending and is not in force, so do not write contract language or marketing claims that assume its requirements already apply. Plan your control set against the current rule and track the proposal with your counsel.

When a SOC 2+ report is worth the added scope

A SOC 2+ report adds criteria or subject matter to one examination rather than running a second audit. The six checks below decide whether that extra scope pays off, or whether it delays the core SOC 2 for little gain.

A named customer requires the framework

Start with the contract or questionnaire. If a customer or regulator asks for HIPAA-related criteria, C5 or CSA STAR Attestation by name, the added scope has a clear buyer. Get the exact requirement in writing, including whether the customer wants a report, a mapping or a certification, because those are different deliverables.

Extra criteria map to existing controls

Map each added criterion to controls the system already runs, such as access reviews, logging, change approvals and backup tests. If a criterion needs a control that does not exist, the cost moves from the examination into engineering work. Ask the auditor whether the additional criteria can be tested against the same control set.

One report replaces several questionnaires

When several customers send overlapping security questionnaires, a single SOC 2+ report can answer many of them. This only holds if the added criteria match what those customers ask. A report that covers the wrong framework still leaves the questionnaires open, so compare the request list against the criteria before committing.

Subject matter stable across one period

A Type 2 examination tests operating effectiveness over a period. If the added subject matter changes often, such as a platform being rebuilt or a new data flow starting mid-period, testers will have to examine two different environments. Choose added scope only where the controls are settled for the whole observation window.

Core SOC 2 date stays protected

Adding scope increases the testing, evidence and description work for the same report date. Confirm with the CPA firm how the added criteria affect fieldwork timing and the system description. If a customer deadline would be missed by the extra work, run the core SOC 2 first and add the framework at the next cycle.

Named owner for each added control

Every added criterion needs an accountable owner who can explain the control, produce its evidence and answer auditor questions. Without named owners, evidence gathering stalls and exceptions go unexplained. Assign owners in the control matrix before fieldwork, and confirm that each owner understands the added framework's requirements.

What a SOC 2 opinion does not say about legal compliance

A SOC 2 opinion does not certify that the organization complies with HIPAA, GDPR or any other law. The AICPA staff FAQs issued in December 2020 address this directly: whether a SOC 2 opinion covers compliance with laws and regulations. The opinion reports on whether management's description of the system is fairly presented and whether the controls in scope were suitably designed and, in a Type 2 report, operated effectively against the Trust Services Criteria. It tests the controls against the criteria the service organization chose. It does not test whether the organization's conduct meets the statute. A SOC 2+ report adds other criteria or subject matter to the same examination, but the added subject matter is still measured against the stated criteria, not against the law itself.

Consider an illustrative case. A healthtech vendor's SOC 2+ report includes HIPAA-related criteria and carries a clean opinion on the controls tested. Separately, a regulator later finds that the vendor's business associate agreements with a subcontractor were out of date. The auditor's clean opinion can be accurate, because the controls the vendor described and tested were designed and operated as stated, while the regulatory finding still stands. The report and the finding answer different questions. A health customer reading the report should not conclude that every HIPAA obligation was tested.

Before you rely on a SOC 2+ report for regulatory assurance, ask your counsel to map which obligations the report reaches and which it does not. Check the criteria listed in the report, the system description boundary, the period covered and whether any requirement you care about appears only as a management assertion. Ask the vendor which HIPAA safeguards, GDPR duties or contractual commitments fall outside the examination, and who owns each gap. Your counsel and compliance team, not the auditor, decide whether the report is enough for your legal position.

How a SOC 2+ examination is scoped and reported

The sequence turns a standard SOC 2 into a single report that covers the Trust Services Criteria plus the added criteria or subject matter, with each phase producing a written artifact the auditor can test.

Agree the added criteria in writing
Before any control work starts, the organization and its CPA firm agree in writing which additional criteria or subject matter will be covered, such as HIPAA-related safeguards, the CSA Cloud Controls Matrix for CSA STAR Attestation, or the C5 criteria. The engagement letter should name each framework, its version, and whether it is reported alongside the Trust Services Criteria. The output is a signed scope statement. Confirm with the firm that the added items are acceptable in a SOC 2 examination and whether a separate attestation or certification body is also needed for the added framework.
Map added criteria to existing controls
The team, usually with the compliance lead and the engineers who own each system, maps every added criterion to the controls already in the SOC 2 control matrix. Many items overlap with common criteria such as access control, logging, change management and vendor oversight, but some will need new controls or stricter versions of existing ones. The output is a crosswalk showing each added item, the control that addresses it, the owner, and the gaps still open. Gaps must be closed before the observation period starts so the auditor can test them over time.
Extend the system description
Management updates the system description to explain how the added criteria or subject matter apply to the in-scope system, including the infrastructure, data flows, people and third parties involved. For a SOC 2+ report, the description must cover the added subject matter clearly enough that a reader can tell what was tested. The output is a revised draft that the CPA firm reviews against the description criteria. Ask the firm how the description will be structured in the report and whether any items are excluded from scope and why.
Add tests and evidence for added items
The auditor designs procedures for each added criterion, typically a mix of inquiry, inspection of documents and re-performance of controls. For a Type 2 report, the added controls must operate across the observation period, so evidence such as access review records, training completions, vulnerability scan results or change tickets must be collected continuously. The output is an evidence library indexed to each criterion. Check that the evidence is retained in a form the auditor can sample and that the same artifacts serve both the Trust Services Criteria and the added items where they overlap.
Obtain management representations
Because a SOC 2 is an assertion-based examination, management provides written representations to the service auditor covering the system description, the design and operation of controls, and the added criteria or subject matter. Management is responsible for the accuracy of these statements, and the auditor relies on them. The output is a signed representation letter that covers every added item in scope. Ask the firm for its illustrative representation letter format so the added items are referenced explicitly.
Receive the single SOC 2+ report
The CPA firm completes its fieldwork, documents its findings and issues one report that contains the Trust Services Criteria results together with the added criteria or subject matter. Any exceptions or deviations are reported in the relevant sections, and management responses are included where provided. The output is a single report with an opinion from the independent auditor, which the organization may then share under the restrictions that apply to SOC 2 reports. Only the CPA firm issues the report; the implementation partner does not.

What must be in place before the examination

A SOC 2+ report is only as credible as the controls and evidence behind the added criteria. The items below are the decisions and records to settle before the CPA firm starts fieldwork, so that the added framework is tested as designed rather than explained after the fact.

A control matrix that includes added criteria

Extend the SOC 2 control matrix so every added criterion, such as a HIPAA safeguard, a CSA Cloud Controls Matrix control or a C5 requirement, has its own row. Each row should name the control, its owner, its frequency and the evidence that proves it ran. A control that appears only in a framework crosswalk, with no operating owner, will be the first thing a service auditor questions.

A current system description

Update the system description so it covers the services, infrastructure, data flows and boundaries that the added criteria touch. Health or cloud customers will read it closely to judge scope. If the description omits a system that handles protected health information or cloud customer data, the report may not answer the question the customer asked.

Named evidence owners for each added control

Assign one accountable person to each added control, separate from the person who performs it where possible. Owners should know which system generates the evidence, where it is stored and how long it is kept. Ask the auditor for a sample evidence list early, because controls with no named owner tend to produce gaps in the observation period.

A mapping to the framework text the customer cited

Map each added control to the specific provision the customer named, such as a HIPAA Security Rule standard or a particular CSA CCM control. Write the mapping from your own reading of the framework, not from a generic crosswalk. Keep it in the same document as the control matrix so the auditor and the customer's security team can trace one control to one requirement.

Confirmation from the CPA firm

Before signing, confirm in writing that the CPA firm is authorized to report on the added framework and has the skills to test it. Ask whether the firm will issue a combined report and how it will word the opinion. Frameworks such as HITRUST and CSA STAR have their own assessor or registry rules, so confirm those requirements separately with HITRUST or the CSA rather than assuming the CPA firm meets them.

Assessor and registry requirements to confirm

Where the added criteria come with an external assessment or registry listing, check its entry requirements, submission steps and renewal terms before the examination period begins. A CSA STAR Attestation listing, for example, must be updated to stay current. Confirm each requirement with the body that administers it, and record the answers so the examination scope matches what the registry or assessor will accept.

Who owns controls, who prepares evidence and who issues the report

Your organization owns the controls, the system description and every representation made to the examiner. The examiner's report describes what management says the system does and tests whether those statements hold, so the people who run the service must be accountable for the content. Leadership also decides which additional criteria or subject matter belong in scope, because that decision changes what customers rely on.

Control ownership: Named owners run each control, approve exceptions and decide when a control has failed.
System description: Management writes and maintains the description of the system, including the services, boundaries and subservice organizations.
Management representations: Leadership signs the written representations the examiner requires, so statements in the report trace back to accountable people.
Scope decisions: Leadership decides whether HIPAA-related criteria, CSA CCM or C5 are added, and records the reasons.
Remediation: Your team fixes gaps found during fieldwork and runs controls continuously through the period.

Ask whether every control has a named owner who can explain it without a consultant in the room.

Common mistakes that expand scope or weaken the report

Most SOC 2+ problems start before the examination begins: frameworks added too early, reports read as covering more than they do, and obligations left unmonitored. Each pitfall below changes what the report says, what it covers, or how long customers can rely on it.

Adding frameworks before core controls are stable

Layering CSA CCM, C5 or HIPAA-related criteria onto a SOC 2 whose base controls still change every quarter multiplies the testing burden and the number of exceptions an auditor can raise. Confirm that access reviews, change management and incident response run consistently for a full period before adding a second framework. Ask the CPA firm whether the additional criteria can be tested in the same examination without re-testing the common criteria.

Treating a provider's combined report as your environment

A cloud provider's combined report, such as Microsoft's C5:2020, SOC 2 Type 2 and CSA STAR Attestation report for Azure, describes that provider's controls, not the controls you run on top of it. Your own application, identity configuration, data handling and staff processes sit outside that opinion. Check the carve-outs and the complementary user entity controls the provider lists, then map each one to a control you operate yourself.

Claiming HIPAA or C5 compliance from a SOC 2

A SOC 2 opinion reports on whether controls were suitably designed and operated against the criteria in scope. It does not state that the organization complies with HIPAA, C5 or any other law or regulation, and the AICPA staff FAQs address this question directly. Marketing copy that says a SOC 2 proves HIPAA compliance can mislead customers and create exposure under the same contract and regulatory terms. Limit claims to what the report's opinion states.

Letting the CSA STAR listing lapse

CSA STAR Attestation is a SOC 2 engagement combined with the CSA Cloud Controls Matrix, and its registry listing expires after one year unless updated. A customer who checks the registry after that date will find an outdated entry even if the underlying SOC 2 remains current. Assign an owner for the annual update, calendar it against the examination period, and confirm the listing matches the CCM version the auditor tested.

Skipping carve-outs and complementary user entity controls

Subservice organizations excluded from the examination through carve-outs, and the complementary user entity controls the report says customers must run, both shape what a SOC 2+ report actually protects. An added C5 or HIPAA-related scope that relies on a hosting provider's controls still needs those carve-outs disclosed. Read the complementary user entity control list before signing, and confirm which of those controls your organization has agreed to operate.

Questions buyers ask about SOC 2+ reports

Does a SOC 2+ report cost more than a SOC 2?

Usually yes, because the auditor does more work, but the increase depends on how much extra scope you add. A SOC 2+ report is still one examination, so you avoid paying for a separate engagement, yet each added criterion or subject matter needs its own control design, testing and evidence. The cost drivers are the number of extra frameworks, how many of their requirements map to controls you already run, how many systems and locations fall in scope, and whether the auditor needs specialist knowledge of the added framework. Ask the CPA firm for a fee quote that separates the base SOC 2 from each added criteria set, and ask your implementation partner for a written scope that lists the controls to be built or changed. Neither figure is published as a standard rate.

Can one SOC 2 examination cover HIPAA?

A SOC 2 examination cannot certify HIPAA, but the AICPA's SOC 2+ approach allows a report to address criteria or subject matter beyond the trust services criteria in the same engagement. Whether a health-related criteria set can be added depends on the auditor's acceptance of that set, how it is defined, and whether it is suitable for a SOC 2 report. Healthcare customers also ask about the HIPAA Security Rule, which applies to business associates through 45 CFR 164.302. Confirm with the CPA firm which HIPAA-related criteria it will examine and how it will report them, and confirm with your health customers which requirements they expect to see addressed.

Does CSA STAR Attestation need a separate audit?

CSA STAR Attestation is built on a SOC 2 engagement combined with the Cloud Security Alliance Cloud Controls Matrix, so it is normally delivered through the same examination rather than a second audit. The CCM mapping and its version, such as CCM v4 as used in Microsoft's Azure reporting, must be addressed within the SOC 2 work. Registry listings expire after one year unless updated, so plan a recurring update cycle. Ask your CPA firm whether it is licensed to perform STAR Attestation engagements and which CCM version it will test against.

Does a SOC 2+ report prove HIPAA compliance?

No. A SOC 2+ report is an attestation about the controls and criteria the auditor examined, over the period and scope stated in the report. It does not determine whether you comply with HIPAA, GDPR or any other law, and the AICPA's staff guidance addresses this distinction directly. HIPAA compliance is determined by the covered entity or business associate, through its own risk analysis and safeguards, and enforced by the HHS Office for Civil Rights. Health customers should read the report's criteria, scope and exceptions, then decide with their own counsel whether it satisfies their obligations.

Can our team build a SOC 2+ without an outside consultant?

Your team can, if it has people who understand the SOC 2 examination and the added framework. The organization owns its controls and its management assertion, so internal staff must lead the design, ownership and evidence collection in any case. An outside partner can help prepare systems, controls and evidence, but it cannot issue the report. Only an independent CPA firm can examine the controls and issue the opinion. Think through whether your team has time to run the added controls through at least one full observation period, because gaps usually surface during testing rather than during design.

What does a SOC 2+ engagement need from us?

The engagement needs a clear system description, a named owner for each control, and evidence that the controls operated across the examination period. Start by listing every added criterion or framework and mapping it to your existing controls and gaps. Then collect the artifacts the auditor will request, such as access reviews, change records, vulnerability scans and training logs, and confirm that they are retained in a form the auditor can sample. Expect to provide:

A written scope that names the systems, locations and subservice organizations included
Management's assertion and the representation letter the auditor requires
Named control owners who can explain how each control operates
Access to your ticketing, logging and infrastructure records for sampling

What should we confirm before adding criteria to a SOC 2?

Confirm the business reason first, because a customer request is different from a requirement that the report must satisfy. Ask the customer which criteria or subject matter it needs to see, whether it accepts a SOC 2+ report, and whether it wants a bridge letter for gaps between periods. Then ask the CPA firm whether it can examine the added subject matter, how it will describe the criteria in the report, and how exceptions will be presented. Finally, confirm the report's period and distribution limits, since a SOC 2 report is generally restricted in use.

How DeployOpen prepares systems and evidence for a SOC 2+ examination

DeployOpen prepares the systems, controls and evidence that a SOC 2+ examination tests, including any added HIPAA-related, CSA CCM or C5 criteria. The organization owns its controls and the independent CPA firm issues the report, while DeployOpen plans and documents the technical work inside your own environment.

How we scope

Engagements are fixed-scope, with the added criteria, systems and period agreed in writing before work starts.
The written scope names each added framework and the common criteria it overlaps with, so the auditor can test them once.
Scope also lists which subservice organizations and complementary user entity controls the report will describe.

How we build

Controls for each added criterion are mapped to the systems, configurations and logs that will show them operating.
Self-hosted open-source platforms are hardened and configured inside your cloud accounts, data centers or air-gapped networks.
Access, logging, backup and change records are set up so that evidence is generated as a by-product of normal operation.

How we hand over

You receive a control-to-evidence matrix showing which artifact supports each common and added criterion.
Written runbooks and system documentation support the system description your management team prepares.
Evidence packages are organized for the CPA firm, which decides what to sample and issues the report.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the examination period begins.
Retainers can cover evidence refreshes, control changes and preparation for the next examination cycle.
Before choosing an auditor, confirm that the CPA firm accepts the added criteria and the subject matter in your scope.