What SOC 2 is
SOC 2 is an attestation report issued by an independent CPA firm under the AICPA's Trust Services Criteria. Enterprise customers ask for it to understand how a service provider protects their data.
The criteria cover five categories:
- Security — always in scope (the "common criteria")
- Availability
- Processing integrity
- Confidentiality
- Privacy
Choose the optional categories based on what you promise customers, not to make the report look bigger.
Type I vs Type II
| Type I | Type II | |
|---|---|---|
| Question answered | Are controls suitably designed? | Did controls operate effectively? |
| Timeframe | A point in time | An observation period, commonly 3–12 months |
| Customer value | Useful first step | What most enterprise buyers expect |
A Type I report says your controls exist and are designed properly on a given date. A Type II report tests whether they actually worked throughout a period, using samples of evidence.
Which one should you pursue?
- If a deal is waiting and you have never been audited, a Type I shows good faith quickly
- If you are selling into regulated or large enterprises, plan for Type II from the start — many buyers accept Type I only as a bridge
Readiness plan
1. Scope the system
Define the services, infrastructure, people and third parties in scope. A tight scope keeps the audit focused.
2. Gap assessment
Compare existing controls with the criteria. Typical gaps: access reviews, change management evidence, vendor management and incident response testing.
3. Remediate and automate evidence
Controls that generate evidence automatically — ticketed changes, periodic access reviews, centralised logs — make Type II far less painful.
4. Start the observation period
Once controls are stable, begin the Type II window. Missing evidence in month two cannot be recreated later.
Common mistakes
- Starting the observation period before controls are operating
- Ignoring sub-service organisations such as cloud providers
- Treating SOC 2 as a one-off instead of an annual cycle
Key takeaways
- Type I checks control design at a point in time; Type II tests operation over a period.
- Security is always in scope; add other criteria only for what you promise customers.
- Automate evidence before starting the Type II observation window.
Frequently asked questions
How long is a SOC 2 Type II observation period?
Commonly between three and twelve months. Many first-time reports use a shorter window, then move to twelve months for annual renewals.
Is SOC 2 a certification?
No. It is an attestation report issued by an independent CPA firm, describing your system and the auditor's opinion on your controls.
Can SOC 2 and ISO 27001 share controls?
Yes. There is significant overlap, so one well-designed control set with shared evidence can support both.
Customers buy the report; auditors test the habits.
We help SaaS and IT service providers prepare for SOC 2 alongside ISO 27001 so one control set serves both.
