Audit and compliance
System description
Also called: SOC 2 system description, description of the system
The system description is the section of a SOC 2 report where management describes the system being reported on: its boundaries, components, the services delivered, and the controls in place. It defines what the report covers.
It is also the reference point for testing scope. A penetration test whose scope does not match the system description is evidence about a different system.