Encryption requirements for SOC 2 - data at rest, in transit, and in use

Encryption requirements for SOC 2 - data at rest, in transit, and in use

Encryption is one of the most important mechanisms for protecting data in environments subject to a SOC 2 audit. However, SOC 2 does not mandate a single cryptographic technology or a fixed list of algorithms. Instead, it expects organizations to apply reasonable and widely accepted security practicesthat effectively protect information and align with the organization's risk profile.

In practical terms, this means implementing encryption across several critical stages of the data lifecycle. Data should be protected when it is stored in systems, when it moves across networks, and when it is processed by applications. Together, these three layers form the foundation of a resilient security architecture that supports SOC 2 compliance while also protecting sensitive information from common operational threats.

What encryption means in SOC 2?

SOC 2 is an audit framework built on the Trust Services Criteria. Within this framework, auditors evaluate whether an organization can protect systems and data through well‑designed and consistently applied controls. Encryption plays a central role in this evaluation because it directly supports several security objectives.

Most notably, encryption strengthens the Security and Confidentiality criteria. It reduces the likelihood that sensitive information will be exposed to unauthorized parties. However, simply enabling encryption technologies is not enough. Auditors also examine how consistently encryption is implemented across the infrastructure and whether the organization can demonstrate that these controls operate effectively.

For this reason, three aspects tend to receive particular attention during a SOC 2 review. First, auditors assess the scope of encryption, meaning which systems and data assets are actually protected. Second, they look at consistency. Encryption that exists in only part of the environment does not provide meaningful protection. Third, they evaluate how cryptographic keys are managed and whether the organization maintains documentation and evidence demonstrating proper key usage.

When data is classified as confidential - often due to contractual commitments with customers - encryption naturally becomes a critical part of the organization's control environment.

Encryption for data at rest

Data at rest refers to information that is stored within an organization's systems. This category includes databases, files stored in repositories, disk volumes, virtual machine images, backups, and exported reports.

At first glance, protecting stored data may seem straightforward. In practice, however, many organizations focus primarily on encrypting production databases while overlooking other storage locations. Sensitive data can also appear in backups, temporary files, exported datasets, or system logs. If these locations are not encrypted, they can become convenient access points for unauthorized users.

As a result, SOC 2 audits typically examine not only whether encryption has been enabled but also whether it is applied consistently throughout the infrastructure. In a well‑designed environment, encryption should be enabled by default for storage services. This approach ensures that databases, storage volumes, and backups all benefit from the same baseline level of protection.

Equally important is the ability to restore encrypted data. Encryption must not disrupt recovery processes. Organizations should therefore be able to demonstrate that encrypted data can be successfully decrypted and restored during incident response or disaster recovery scenarios.

In practice, widely adopted algorithms include AES with a minimum key length of 128 bits, while many organizations prefer AES‑256 for stronger long‑term protection. For asymmetric cryptography, RSA‑2048 remains a common baseline, although stronger variants are increasingly recommended.

Encryption for data in transit

Another essential element of a data protection strategy is encrypting information while it travels across networks. This is commonly referred to as protecting data in transit.

Many organizations initially associate this requirement with enabling HTTPS for their public websites. While that step is important, it represents only a portion of the broader communication landscape. Data frequently moves between microservices, between applications and databases, during integrations with external platforms, and across internal infrastructure environments.

If any of these communication paths remain unencrypted, the data flowing through them may be intercepted or manipulated. Consequently, SOC 2 auditors evaluate whether encryption is applied across the entire data flow rather than only at the external perimeter.

In modern environments, the prevailing standard is TLS version 1.2 or newer, with outdated protocols disabled. This configuration helps ensure both confidentiality and integrity for transmitted data.

Furthermore, effective encryption in transit depends on proper certificate management. Organizations should maintain clear control over certificate issuance, validation, and renewal. Monitoring certificate expiration dates is equally important, since expired certificates can disrupt services and weaken security controls.

Protecting data while it is being processed

The third component of an encryption strategy involves protecting information while it is actively processed by applications. This stage of the data lifecycle can be more complex because systems often need to temporarily decrypt data in order to perform operations.

For this reason, SOC 2 does not treat encryption during processing as a universal technical requirement. Instead, it focuses on reducing the risk of exposure when sensitive information resides in system memory or application processes.

Organizations typically address this risk through a combination of complementary controls. These may include restricting privileged access, limiting the logging of sensitive data, minimizing the volume of information processed by applications, and implementing techniques such as masking or tokenization.

In certain environments, more advanced solutions may also be used. For example, isolated processing environments can provide additional safeguards for highly sensitive information. Although such technologies are not mandatory in every case, they can significantly strengthen the protection of critical data assets.

Cryptographic key management

Encryption cannot function securely without proper cryptographic key management. In fact, the way keys are generated, stored, and controlled often determines the true effectiveness of the encryption strategy.

If encryption keys are stored improperly or accessible to too many users, even the strongest cryptographic algorithms may fail to provide meaningful protection. As a result, SOC 2 places strong emphasis on structured key management processes.

Organizations should define and document the full lifecycle of each cryptographic key. This lifecycle typically includes key generation, distribution, secure storage, rotation, and eventual retirement. Each stage should be governed by strict access controls and supported by continuous monitoring.

Many environments rely on specialized technologies such as key management systems (KMS) or hardware security modules (HSM). These platforms help enforce access controls and provide detailed logging of cryptographic operations, which in turn supports both security monitoring and audit evidence.

Demonstrating that encryption controls work

Within the SOC 2 framework, it is not enough to claim that encryption has been implemented. Organizations must be able to show that these controls operate effectively in real environments.

Evidence may take several forms. Typical examples include system configuration screenshots, logs showing the use of cryptographic keys, reports generated by monitoring tools, and the results of security testing. Together, these artifacts demonstrate that encryption controls are active and functioning beyond written policy documents.

Auditors also examine the consistency of this evidence. If encryption is properly implemented in one area but absent in another, it may indicate gaps in the organization's security governance or implementation practices.

Why encryption matters in vendor relationships

Many organizations now request a SOC 2 report before onboarding a new vendor or technology partner. As a result, the strength of an organization's data protection strategy has become an important factor in establishing trust and credibility.

Encryption plays a central role in this evaluation. It signals that a company takes the protection of sensitive information seriously and follows established security practices.

A well‑designed encryption strategy therefore spans the entire data lifecycle. Data should remain protected while stored in systems, while transmitted between services, and while processed by applications. When these three layers work together, they create a coherent security model that supports SOC 2 expectations and provides meaningful protection for organizational data.