SOC 2: The Complete Guide for SaaS and IT Companies

SOC 2 is an independent auditor’s report on how a service organisation protects the systems and data it uses to serve customers. It is defined by the AICPA (American Institute of Certified Public Accountants) and measured against the Trust Services Criteria. No law requires SOC 2, but it has become the default security evidence US companies ask their SaaS and IT vendors for, and many buyers outside the US ask for it too.

What is SOC 2?

SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls and issues a report that includes its opinion. There is no pass mark and no certificate: the report describes your system, your controls, the tests the auditor performed and any exceptions found. Your customers read it and decide whether they are comfortable.

The report is usually shared under a non-disclosure agreement, because it contains detail about your security set-up.

Type 1 vs Type 2:

See SOC 2 Type 1 vs Type 2 for help choosing.

SOC 1, SOC 2 and SOC 3:

• SOC 1 covers controls relevant to your customers’ financial reporting, such as payroll or billing platforms.
• SOC 2 covers security and the other trust services categories.
• SOC 3 is a short, general-use version of a SOC 2 report that you can publish on your website.

History and why it was introduced

SOC 2 was introduced because cloud and outsourced services became central to how companies run, and customers needed reliable evidence about controls outside the financial reporting scope of SAS 70.

Main objectives:

1. Give customers independent assurance about a vendor’s controls.
2. Use a common set of criteria so reports are comparable.
3. Reduce the number of individual security audits and questionnaires vendors face.
4. Encourage ongoing control operation, not one-off preparation (Type 2).

Who needs SOC 2?

Industries: SaaS, cloud infrastructure, fintech, healthcare technology, HR and payroll, data analytics, cybersecurity vendors and IT outsourcing.

Geography: SOC 2 is a US framework, but the report is accepted worldwide. Only CPA firms licensed in the US (or firms working under the AICPA’s standards through a licensed affiliate) can issue SOC 2 reports.

Is SOC 2 mandatory?

No law requires SOC 2. It becomes mandatory in practice when:

• a customer contract or security addendum requires a current SOC 2 Type 2 report;
• a procurement process won’t move forward without it; or
• your customers need it as evidence for their own regulations, for example HIPAA, SOX or GLBA.

Key requirements: the Trust Services Criteria

You choose which categories are in scope. Security is always included.

The Common Criteria (CC1 to CC9)

The criteria are written as outcomes. The AICPA’s points of focus describe what a control usually addresses, but you decide how to meet each criterion.

How to implement SOC 2

1. Decide the scope. Which product or service, which systems, which locations, and which trust services categories. Most first-time SaaS reports cover security only, or security plus availability and confidentiality.
2. Run a readiness assessment. Compare your current controls with the criteria and list the gaps. This can be done internally, with a consultant, or with the audit firm (as a separate engagement).
3. Fix the gaps. Typical work: SSO and MFA everywhere, device management, central logging and alerting, formal change management in Git, access reviews, vendor reviews, a tested incident response plan and backups.
4. Write policies that match what you actually do.
5. Choose an audit firm. Compare experience with companies like yours, approach to evidence, and timeline.
6. Type 1 (optional). Get a point-in-time report to show customers quickly.
7. Run the observation period. Operate the controls and collect evidence for the agreed period.
8. Type 2 fieldwork. The auditor samples evidence across the period, interviews staff and tests controls.
9. Receive the report and share it under NDA. Plan the next period straight away: reports are normally renewed every year.

Typical timeline: a cloud-native company with reasonable security can usually be ready for a Type 1 in about 2 to 4 months. A Type 2 then adds the observation period plus a few weeks for fieldwork and report writing. Timelines vary widely with your starting point.

Documentation and policies

There is no official list of mandatory SOC 2 documents. Auditors usually expect:

• Information security policy and topic policies (acceptable use, access control, change management, incident response, business continuity and disaster recovery, vendor management, data classification and retention, encryption)
• System description (part of the report, written by management)
• Risk assessment and risk register
• Asset and vendor inventories
• Organisation chart and role descriptions
• Employee onboarding and offboarding records, background checks and training records
• Access review records
• Change tickets and pull request approvals
• Incident records and post-incident reviews
• Backup and restore test results
• Penetration test and vulnerability scan reports
• Board or management meeting notes on security oversight

The audit and the report

A SOC 2 report usually contains five sections:

1. Independent service auditor’s report: the opinion. An unqualified opinion means the auditor found controls met the criteria; a qualified opinion means some criteria were not met.
2. Management’s assertion: your statement that the description is fair and the controls are suitable and (for Type 2) operating effectively.
3. System description: services, infrastructure, software, people, data, procedures, and complementary user entity controls (what customers must do themselves).
4. Trust services criteria, controls, tests and results: each control mapped to criteria, how the auditor tested it, and any exceptions.
5. Other information (optional): management responses to exceptions.

Exceptions are normal. A few minor exceptions with good explanations rarely worry customers. Many exceptions on key controls such as access removal or change approval do.

Validity: a SOC 2 report has no formal expiry, but buyers generally want the period to have ended within the last 12 months, plus a bridge letter from you covering the gap since then.

Cost

SOC 2 costs depend on scope, company size, number of trust services categories, the audit firm and how ready you are. Rather than a single figure, plan for these cost areas:

Ask audit firms for a fixed fee per report and what is included, such as readiness, Type 1 and the first Type 2.

Benefits

• Unblocks enterprise deals and shortens security reviews.
• Replaces many custom questionnaires with one report.
• Forces good habits: access reviews, change control, incident response.
• Gives leadership independent insight into security.
• Builds trust with investors and acquirers during due diligence.

Risks of not having it

• Lost or delayed deals with US mid-market and enterprise buyers.
• Weeks spent on custom questionnaires and security calls.
• Higher contract risk: customers may demand extra audits or stronger liability terms.
• Weaker position in due diligence for fundraising or acquisition.

Common mistakes

• Calling it a certification. Say “we have a SOC 2 Type 2 report”, not “we are SOC 2 certified”.
• Over-scoping the first report, for example adding privacy and processing integrity when no customer has asked.
• Policies that don’t match reality. Auditors test what the policy says you do.
• Forgetting the observation period. Controls must run throughout it; a missed quarterly access review becomes an exception.
• Ignoring complementary subservice organisation controls. Your cloud provider’s SOC 2 covers its part; you still need to review it.
• Letting the report lapse. Customers expect a new report every year.

Challenges for IT companies

• Small teams struggle with segregation of duties in deployment. Peer review, protected branches and audit logs help.
• Fast change. Infrastructure as code and continuous deployment need change controls that work in pipelines.
• Many SaaS tools each need access control and offboarding.
• Remote and contractor workforces complicate device management and background checks.
• Global customers may also want ISO 27001, GDPR evidence or CSA STAR.

Best practices

• Start with security only; add categories when customers ask.
• Get a Type 1 early if a deal depends on it, then move to Type 2.
• Automate evidence collection from your cloud, identity and code platforms.
• Run controls on a calendar: quarterly access reviews, annual risk assessment, annual training, annual tabletop exercise.
• Review your vendors’ SOC 2 reports, including their complementary user entity controls.
• Combine with ISO 27001 if you sell internationally. Most controls overlap.

Tools that help

How SOC 2 relates to other frameworks

Real-world examples

• Cloud providers. AWS, Microsoft Azure and Google Cloud publish SOC 2 reports to customers through their compliance portals, and their customers rely on those reports for the infrastructure layer.
• SaaS trust centres. Many SaaS companies run a public trust page where prospects can request the SOC 2 report under NDA and download a SOC 3.
• Illustrative scenario, not a real company: a 30-person HR software company loses two US enterprise deals in security review. It scopes a security-only SOC 2, closes gaps in device management and access reviews over three months, gets a Type 1 to keep the deals alive, and completes a six-month Type 2 the following year.

Frequently asked questions

Is SOC 2 a certification? No. It is an attestation report with an auditor’s opinion. There is no SOC 2 certificate.

Is SOC 2 mandatory? No law requires it. Customers often require it by contract.

What is the difference between SOC 2 Type 1 and Type 2? Type 1 looks at control design at one date. Type 2 also tests that controls worked over a period, typically 3 to 12 months.

How long does a SOC 2 report last? It has no formal expiry, but most customers want a report covering a period that ended in the last 12 months, plus a bridge letter.

Who can perform a SOC 2 audit? A licensed CPA firm, following AICPA attestation standards.

Do we need all five trust services categories? No. Security is required. Add others only when your services and customers make them relevant.

Can a non-US company get SOC 2? Yes. Companies worldwide get SOC 2 reports from US-licensed CPA firms or their international affiliates.

Can we share our SOC 2 report publicly? SOC 2 reports are restricted-use and normally shared under NDA. A SOC 3 report can be shared publicly.

What is a bridge letter? A letter from management stating that no material changes to controls have occurred between the end of the last report period and today.

Does SOC 2 cover GDPR or HIPAA? Not by itself. The privacy category and mapped controls help, but each law has its own requirements.

Next steps

• List the customers asking for SOC 2 and what they expect (Type 1 or Type 2, categories, deadline).
• Draft your scope and system boundaries.
• Run a readiness assessment against the Common Criteria.
• Shortlist two or three CPA firms and compare their proposals.
• Fix high-impact gaps first: SSO and MFA, device management, logging, change control.