Before your team gives a software vendor access to its repository of legal agreements and sensitive business information, that vendor needs to show you their SOC 2 Type II attestation and audit report. And if the vendor doesn't have a SOC 2 Type II report—or, worse, doesn't know what SOC 2 is—that's a huge red flag. Here's why.

The "SOC" in SOC 2 stands for service organization controls. A service organization is any service provider, from your ISP to the local power company to your cleaning service. Controls are processes and documentation that make sure a company is currently well run, has been run well in the past, and thus is likely to be well run in the future.

SOC 2 is a compliance standard set up by the American Institute of Certified Public Accountants (AICPA) to make sure businesses don't take on undue risk when they hire a service provider. More simply, SOC 2 is proof that the vendor you're hiring will be able to offer a reliable service and, more importantly, won't be careless with the information you share with them.