Compliance · SOC 2
SOC 2
A US attestation against the Trust Services Criteria, widely expected of technology and SaaS companies selling to US enterprise customers.
Last reviewed . Regulation moves, so check the regulation tracker for the current position.
What it is
An independent report on your controls.
SOC 2 is an attestation performed by a licensed CPA firm against the Trust Services Criteria: security, plus optionally availability, confidentiality, processing integrity and privacy.
A Type I report assesses your controls at a point in time; a Type II report assesses how they operated over a period, which is what most enterprise buyers want to see.
The criteria
Security is mandatory. The rest are your choice.
Every SOC 2 report covers security, through the common criteria. You add the other categories where they matter to your customers and your service.
- Security: protection against unauthorised access, always in scope
- Availability: the system is available for operation and use as committed
- Processing integrity: processing is complete, valid, accurate and timely
- Confidentiality: information designated as confidential is protected
- Privacy: personal information is handled in line with your commitments
Who needs it
When US enterprise procurement is the gatekeeper.
It is the de facto expectation for SaaS and B2B technology companies selling into US enterprises, and is often a deal-blocker until it is in place.
UK companies with US customers are asked for it just as often as US ones. Where your buyers are mostly UK or European, ISO 27001 is usually the more recognised answer, and the two share much of the same control work.
Type I or Type II
What the auditor looks for, and over what period.
A Type I report is quicker to obtain and shows your controls are designed properly. A Type II report covers an observation period, commonly somewhere between three and twelve months, and shows the controls operated consistently throughout it. Some companies start with Type I to unblock a deal, then move to Type II.
For a Type II report, the auditor samples evidence from across the whole period, so controls that only worked some of the time show up as exceptions.
- Access reviews, and joiners, movers and leavers handled on time
- Change management for code and infrastructure
- Monitoring, alerting and incident response that actually ran
- Vendor and risk assessments kept current
- Policies acknowledged and security training completed
How we help
Get ready, stay ready.
- Scope which criteria apply and whether to start with Type I or Type II
- Map and implement the controls, and stand up evidence collection
- Attestation delivered through certified assessment (CPA) partners
- Keep evidence current so the Type II observation window is painless
FAQ
Questions buyers actually ask
Is SOC 2 a certification?
No. SOC 2 is an attestation: a licensed CPA firm examines your controls and issues a report with its opinion. There is no SOC 2 certificate, which is why buyers ask to see the report itself.What is the difference between SOC 2 Type I and Type II?
Type I assesses whether your controls are suitably designed at a single point in time. Type II assesses whether they operated effectively over an observation period. Most enterprise buyers ultimately expect Type II.How long does a SOC 2 Type II take?
It depends on your readiness and the observation period you choose, which commonly runs from three to twelve months. Readiness work comes first, then the observation period, then the auditor’s fieldwork and report.Can a UK company get a SOC 2 report?
Yes. UK companies selling to US customers commonly obtain SOC 2 reports. The report has to be issued by a licensed CPA firm, which is why the attestation itself is delivered through our certified assessment partners, who are licensed CPA firms.Should we do SOC 2 or ISO 27001?
Follow your customers. US enterprise buyers usually ask for SOC 2; UK, European and international buyers more often ask for ISO 27001. The controls overlap heavily, so if you need both, building them together avoids doing the work twice.How often does a SOC 2 report need renewing?
A Type II report covers a fixed period, so customers generally expect a new report each year. Keeping evidence current between reports is what makes the next observation period routine.
Need SOC 2 to close deals?
Tell us your target timeline and customer requirements; we’ll map the fastest credible route.
Book a call Also available in AWS Marketplace