SOC 2 guide
SOC 2: Type I, Type II and finding the right help
A SOC 2 report is an independent auditor's opinion on the controls a service organisation uses to protect customer data and systems. It is common in B2B software sales, especially to US customers, where buyers ask for it during vendor security reviews.
SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls against the AICPA Trust Services Criteria and issues a report that you share with customers under NDA.
Published 28 October 2026. Last reviewed 6 November 2026. This guide is general information, not legal advice.
The Trust Services Criteria
Every SOC 2 covers Security, also called the common criteria. You can add any of the other four categories when they matter to your customers:
- Security (required)
- Availability
- Processing integrity
- Confidentiality
- Privacy
Which version of the criteria applies
SOC 2 examinations use the 2017 Trust Services Criteria, with points of focus revised in 2022. Points of focus are guidance on how to meet a criterion, not extra requirements.
In October 2026 the AICPA published exposure drafts of proposed 2027 Trust Services Criteria and Description Criteria, open for comment until 15 January 2027. If adopted, they would apply to engagements beginning on or after 31 December 2027, with early adoption permitted. Until then the 2017 criteria apply.
Type I and Type II
A Type I report covers whether your controls are suitably designed at a specific date. A Type II report covers whether they were designed and operated effectively over a period, commonly between three and twelve months. Most enterprise buyers ask for Type II; many companies start with a Type I to unblock deals while the Type II observation period runs.
What getting a SOC 2 involves
- Scoping: which systems, teams and criteria the report will cover
- Readiness: a gap assessment against the criteria and a remediation plan
- Remediation: policies, access reviews, change management, logging, vendor management, incident response and the other controls you are missing
- Evidence: collecting proof that controls operate, often with a compliance automation tool
- Audit: a CPA firm tests the controls and issues the report
What good SOC 2 help looks like
Readiness consultants and vCISOs design and implement the programme; a separate CPA firm performs the audit. Under the AICPA's independence rules, the firm that examines your controls cannot also design, implement or operate them, or make management decisions about them.
Ask providers for SOC 2 programmes they have taken through a Type II, the tools they work with, and who will own the programme after they leave.
How CISO Talents helps
At launch you can post an ISO 27001 or SOC 2 readiness request through a guided brief: size, stack, deadline and which report your customers want. Verified providers who list SOC 2 work see it with the reason it matched, and reply in a common format.
Frequently asked questions
Is SOC 2 a certification?
No. A SOC 2 is an attestation report: an independent CPA firm gives an opinion on your controls. There is no SOC 2 certificate, although people often use the word loosely.
Should we do SOC 2 or ISO 27001?
It depends on your buyers. US customers tend to ask for SOC 2, while European and international customers often prefer ISO 27001. The control sets overlap a lot, so many companies plan for one and map to the other later.
How long does a SOC 2 take?
Readiness work often takes a few months depending on your starting point. A Type II then needs an observation period, commonly three to twelve months, before the auditor can issue the report.
