Why It Matters
Law firms and corporate legal teams commonly require SOC 2 Type II from software vendors. A Type I report only covers design at a single point in time, so ask which one a vendor has, its date and any exceptions noted.
Related Terms
- ISO 27001
- An international standard for information security management. Certification means an accredited auditor confirmed the vendor runs a formal security program.
- Vendor security questionnaire
- A standard set of questions a buyer sends a software vendor about security, privacy, data handling and AI before signing.
- Penetration test
- An authorized simulated attack on a system by security specialists to find weaknesses before real attackers do.
General information, not legal advice. Part of the Legal Tech Glossary, 173 terms in plain English.