SOC 2 compliance: the report, the criteria and how to prepare

What SOC 2 is

SOC 2 (System and Organization Controls 2) is a reporting framework from the AICPA. A licensed CPA firm examines the controls you use to protect customer data and writes a report containing its opinion. There is no certificate, certification body or pass mark. The report describes your system, your controls, the tests the auditor ran and any exceptions it found.

This matters when you talk to buyers. Strictly, you cannot “be SOC 2 certified”. You hold a SOC 2 report, scoped to a defined system and a defined period, and you share it under NDA with customers who ask for it.

The auditor checks whether your controls exist and are designed to meet the criteria you chose. For Type II, the auditor also checks that they kept working throughout the period.

Who needs SOC 2, and when

Demand for SOC 2 comes from buyers rather than regulators. If you sell software to US mid-market or enterprise companies and hold their data, a request usually arrives with the first serious deal, from procurement or the customer’s security team. Companies selling mainly into Europe, the UK or APAC are more often asked for ISO 27001 first, and many end up needing both.

In practice, a deal is usually what starts the work. If a security questionnaire or a “can you share your SOC 2 report?” email is already in your inbox, you are behind. If not, start well before you expect the request, so a Type II observation period can run while you sell.

• B2B SaaS selling into US enterprise accounts
• Companies that store or process data on behalf of other businesses
• Vendors going through a formal procurement or third-party risk review
• Start-ups with a specific deal blocked until a report exists

The five Trust Services Criteria

Every SOC 2 report covers Security, also called the Common Criteria. The other four are optional. Add them only where you make real commitments to customers, because each one adds controls, evidence and audit effort.

Type I or Type II?

Most enterprise buyers eventually expect Type II. Many accept a Type I plus a Type II observation period already under way, which gets a report into a buyer’s hands sooner while the longer window runs. If your controls already operate and nobody is waiting on a report, you can go straight to Type II.

Type I

Are the controls designed to meet the criteria, at a single point in time?

Type II

Did the controls operate effectively across a period, usually three to twelve months?

What the auditor asks for

Auditors ask for the same kinds of evidence in almost every SOC 2 engagement. Fieldwork is shorter when each item is ready, dated and linked to a control.

• Access reviews, with the removals completed
• Joiner and leaver records, including access removed on the last day
• Change tickets showing review and approval before release
• Vulnerability scans and remediation within your own deadlines
• A penetration test report, where your auditor or buyers expect one
• Background checks and security training completion
• Security reviews of critical suppliers
• An incident log, with post-incident reviews
• Backup and restore tests

In Certifyi each piece of evidence sits on the control it supports, and every action on it goes into the tamper-evident activity log, so an edit made after upload can be detected. The log shows that evidence has not been changed. It cannot show that the original evidence was right.

What “operating” means during Type II

During the observation window the auditor samples evidence from across the whole period, not just the last week. Quarterly access reviews need to have happened in each quarter. Leavers need to have lost access on the day they left. Scans need to have run, and findings need to have been fixed within your own deadlines.

So evidence has to be gathered as the work happens. A missed review in March cannot be made up in June.

What SOC 2 costs, and who you pay

There are four cost lines, and software is only one of them. The audit fee always goes directly to the CPA firm. Penetration testing is separate. Internal time is the cost most teams forget to budget.

For typical ranges and the costs that appear after the quote, read how much SOC 2 costs.

Choosing an auditor and running fieldwork

Any licensed CPA firm that performs SOC 2 examinations can issue your report, and the choice is yours. Look for a firm that audits companies of your size and stack, agrees a clear evidence request list up front, and can start fieldwork when your window closes.

Whichever firm you choose, Certifyi lets you give its auditors scoped, read-only access to the evidence for their engagement.

See how to choose a SOC 2 auditor for the questions to ask.

Keeping the report current

A SOC 2 report is dated, and buyers read two things first: the period it covers and the exceptions. Most companies audit every year so there is no gap a buyer can object to. When a buyer asks between reports, a bridge letter covers the months since your last period ended.

Access reviews on a schedule and supplier re-assessments keep the next period clean, and the same controls answer most customer security questionnaires.

SOC 2 alongside ISO 27001, HIPAA and GDPR

Most companies that hold SOC 2 end up with other frameworks too. US buyers ask for SOC 2, European and APAC buyers ask for ISO 27001, health-tech customers add HIPAA, and anyone handling EU personal data answers to GDPR. The controls overlap heavily: access control, change management, logging, supplier management and incident response serve all of them.

What ISO 27001 adds is a management-system layer: scope, a risk method, a Statement of Applicability, internal audit and management review.