What is SOC 2?
The de facto security standard for SaaS and cloud companies
Understanding SOC 2, the five Trust Services Criteria, and why it's the primary compliance requirement for selling to US enterprise customers.
SOC 2 (Service Organization Control 2) is an auditing framework developed by the AICPA that evaluates whether a service organisation's controls meet the Trust Services Criteria (TSC) for security, availability, processing integrity, confidentiality, and privacy.
A SOC 2 audit, conducted by independent CPA firms, results in a SOC 2 report — an attestation, not a certification — demonstrating that your controls meet the standards your enterprise customers require. It is the de facto compliance requirement for SaaS companies, cloud providers, and data processors selling to US enterprise customers.
Unlike ISO 27001, which is a management system certification, SOC 2 is a point-in-time or period-based audit of specific controls. Type II reports cover operating effectiveness over a minimum 6-month observation period — the standard required by enterprise security and procurement teams.
SOC 2 Type 1 vs Type 2 Report
WHERE SOC 2 AUDITS FAIL
The three areas where most SOC 2 findings originate
These are the control domains where CPAs find exceptions most frequently — and where our readiness programme focuses most intensively. Click each to understand exactly what auditors test.
Five criteria, dozens of controls
we implement every relevant one
HOW WE GET STARTED
From first call to CPA-attested report — in four steps
1
Scope & readiness assessment
We define your TSC scope, gap-assess existing controls, and deliver a written readiness report within 2 weeks
2
Control design & documentation
Controls designed, policies written, and evidence collection programme built — ready before the observation period starts
3
Observation period & evidence
Controls operate and evidence is collected throughout the observation period — we review before CPA fieldwork begins
4
CPA audit & report
CPA firm coordinated, audit supported, exceptions resolved, and SOC 2 Type II report issued — annual renewal established
BUSINESS OUTCOMES — What our customers achieve
0
First-time audit failures across 500+ SOC 2 engagements
12–16 wk
Typical readiness to Type II report delivery
500+
SOC 2 Type II reports delivered globally
Annual
Renewal programme keeps report current for client auditors
Enterprise deals unblocked
SOC 2 Type II removes the compliance barrier that blocks enterprise SaaS deals at the security review stage — pipeline moves forward
ISO 27001 pathway included
SOC 2 controls overlap significantly with ISO 27001 — clients who achieve SOC 2 first are 60% of the way to ISO 27001 certification. We design both journeys in parallel where relevant.