SOC 2 is an AICPA attestation by a licensed CPA against the Trust Services Criteria — not a certification. Type II (controls operating effectively over a period) is the report customers ask for. Here is what Score has to put in place, mapped to its actual stack.