SOC 2
Control Deficiency
A gap where a security control is missing, inadequately designed, or not operating effectively. Auditors classify control deficiencies by severity: a significant deficiency affects the audit opinion while an observation is informational.