SOC 2: a plain-language guide
Short answer: SOC 2 is an independent audit report on how a service company protects its customers' data. It is based on the AICPA's Trust Services Criteria and is written by a licensed CPA firm. A Type I report checks your controls on one date. A Type II report checks that they worked over a period, usually three to twelve months.
What is SOC 2?
SOC 2 (System and Organization Controls 2) is a framework from the American Institute of Certified Public Accountants (AICPA). A company describes its system and its controls, and an independent auditor tests them and writes a report. Customers read that report to decide whether they can trust the company with their data.
SOC 2 is an attestation report, not a certificate. There is no "pass" badge; the report contains the auditor's opinion and any exceptions found.
Who needs SOC 2?
SOC 2 is not a legal requirement, but it is often a sales requirement. If you are a SaaS, cloud or IT services company selling to customers in the United States, you will likely be asked for a SOC 2 report during security reviews. Many Indian SaaS companies get SOC 2 when they start selling to US enterprises, and ISO 27001 for customers elsewhere.
What are the SOC 2 Trust Services Criteria?
| Criteria | What it covers |
|---|---|
| Security | Required in every SOC 2. Protection against unauthorised access, through controls such as access management, change management, monitoring and incident response. |
| Availability | The system is available as committed, for example through backups, capacity planning and disaster recovery. |
| Processing integrity | Processing is complete, accurate, timely and authorised. |
| Confidentiality | Information marked confidential is protected and disposed of properly. |
| Privacy | Personal information is collected, used, kept and disposed of in line with your commitments. |
You choose which criteria beyond Security to include, based on what your customers care about.
What is the difference between SOC 2 Type I and Type II?
A Type I report looks at whether your controls are well designed at a single point in time. A Type II report also tests whether they actually operated over an observation period, commonly three to twelve months. Customers usually prefer Type II. Many companies start with Type I to unblock deals and move to Type II the following year.
How do you prepare for a SOC 2 audit?
- Pick the scope and criteria. Which product, systems and Trust Services Criteria will the report cover?
- Do a gap assessment. Compare what you do today with the criteria.
- Fix the gaps. Typical work: written policies, MFA everywhere, access reviews, onboarding and offboarding steps, vendor reviews, logging, backups and an incident response plan.
- Collect evidence as you go. Screenshots, tickets, logs and sign-offs that show each control working.
- Choose an auditor. Only a licensed CPA firm can issue a SOC 2 report.
- Run the audit. For Type II, the auditor samples evidence from across the observation period.
SOC 2 or ISO 27001: which first?
Both cover much of the same ground, so work done for one helps with the other. Choose based on your customers: SOC 2 if most are in the US, ISO 27001 if they are in India, Europe, the Middle East or elsewhere. Many companies end up with both.
How ExpertComply helps with SOC 2
ExpertComply GRC includes a SOC 2 checklist in plain language. Each item says what to do, you track it as done, partly done or not started, and you keep evidence next to it so it is ready for the auditor. Policy templates cover the documents auditors usually ask for first. ExpertComply VAPT helps with the security testing side by scanning your code and website and explaining each fix.
ExpertComply does not issue SOC 2 reports; only a licensed CPA firm can.
See plans Ask for a walkthrough