Maurice Müller
Senior Content Manager
Maurice Müller is a journalist and content strategist with experience in both print and digital media. At Formalize, he transforms complex topics relating to compliance and regulation into clear and practical content for professionals in the fields of compliance, risk and security across Europe.
Key takeaways:
SOC 2 is neither a law nor a certification. An independent firm of chartered accountants (CPAs) reviews a company’s controls and issues a report, which clients usually request during the procurement process.
It is based on five trust service criteria. Security is mandatory in all SOC 2 reports; availability, processing integrity, confidentiality and privacy are optional.
A Type 1 report assesses whether the controls were suitably designed as at a specific date. A Type 2 report also verifies whether the controls operated effectively during a review period, typically ranging from three to twelve months.
SOC 2 and ISO 27001 overlap substantially, but they are different frameworks: ISO 27001 is a more common certification in Europe, whilst SOC 2 reports are more common in North America.
Most of the work takes place prior to the audit: defining the scope, identifying those responsible for the controls, and gathering evidence that the controls operate as described.
A European software company is about to sign a contract with its first major client in the US. Then the security questionnaire arrives, and a single line brings the whole process to a standstill: “Please provide your most recent SOC 2 Type 2 report.” The company holds ISO 27001 certification. Even so, the client’s procurement team insists on receiving the report.
This is how many organisations first come into contact with SOC 2: through a client, rather than a regulatory body. Understanding what the report is, what it covers and how long it takes to obtain it determines whether the deal goes ahead this quarter or next year.
What is SOC 2?
In practice, SOC 2 is an audit. An independent firm of chartered accountants reviews the controls your organisation has in place to comply with one or more of the AICPA’s Trust Services Criteria and issues a report which clients and other stakeholders use to assess how effectively you protect your systems and the information entrusted to you.
SOC 2 is not a fixed checklist. The criteria describe what needs to be achieved, and each organisation designs its own controls to meet them. The AICPA adds ‘focus areas’ to each criterion, but these are considerations, not mandatory controls. The current criteria date from 2017, whilst the focus points were revised in 2022.
SOC 2 is one of three related types of report. SOC 1 covers controls relevant to financial reporting, and SOC 3 is a more concise, general-purpose version of a SOC 2 report that can be shared publicly. Outside the US, comparable assurance reports are issued under the international standard ISAE 3000, which is why some European service providers submit an ISAE 3000 report instead. Find out how Formalize approaches SOC 2.
What does SOC 2 stand for?
SOC 2 stands for ‘System and Organisation Controls 2’. Previously, the term was abbreviated to ‘Service Organisation Control’, and the number distinguishes it from SOC 1 and SOC 3.
Who needs to comply with SOC 2?
SOC 2 certification is not a legal requirement. It becomes relevant when clients request it, which usually happens in the following cases:
SaaS and cloud service providers that host or process customer data.
Technology and data processing companies whose services are integrated into the operations of other organisations.
Managed service providers with access to customers’ systems.
Other service organisations that handle sensitive customer or business data.
This request typically arises during the procurement process, in supplier risk assessments or security reviews, and is particularly common in sales to US companies. Some contracts also require an up-to-date SOC 2 report. If none of your clients request this, an ISO 27001 certification or an ISAE 3000 report may be more appropriate, particularly in Europe.
What are the five criteria of the SOC 2 Trust Services?
Security, also referred to as common criteria, forms part of all SOC 2 reports. The other four are included where they are relevant to the services you provide and the commitments you make to your clients:
Criteria | What it covers | Example controls |
|---|---|---|
Security | Protection against unauthorised access, use or alteration of systems and information | Multi-factor authentication, access reviews, logging and monitoring, change management, incident response |
Availability | Whether the systems are available for operation and use as intended | Backups, disaster recovery testing, capacity monitoring |
Processing integrity | Whether system processing is complete, valid, accurate, timely and authorised | Data validation, reconciliations and quality controls during processing |
Confidentiality | Protection of information deemed confidential | Encryption, data classification, secure disposal |
Privacy | Collection, use, retention, disclosure and disposal of personal data, in line with the organisation’s commitments | Privacy notices, consent records, retention schedules |
There is one aspect that is of particular importance to European organisations: the privacy criterion assesses whether they fulfil their own commitments regarding privacy. That is not what makes an organisation compliant with the GDPR.
SOC 2 compliance requirements: what do organisations need?
As SOC 2 sets out criteria rather than prescribing controls, SOC 2 requirements vary from organisation to organisation. Most programmes, however, must cover the same aspects:
A defined scope covering the services, systems, locations and Trust Service Criteria included in the report.
Policies and controls that comply with the selected criteria, supported by a structured approach to policy management.
Key operational areas, including access, change management, incident response, a risk management system, and third-party and supplier risk management.
Evidence that the controls are in place and, in the case of Type 2, have been operating throughout the entire review period.
Clear accountability and documentation, so that each control has a designated person responsible for it.
A description of the system. Management draws up a description of the system covered by the audit and signs a statement to that effect. Both form part of the final report and are often overlooked during the preparation phase.
Examples of common SOC 2 controls
The common criteria are divided into nine groups, from CC1 to CC9. The checks depend on the scope of the analysis; here are some typical examples for each group:
Area | Example controls |
|---|---|
CC1 Control environment | Code of conduct, background checks, defined security roles, management oversight |
CC2 Communication and information | Policies shared with staff, a description of the system for clients, a channel for reporting incidents |
CC3 Risk assessment | A risk assessment, at least once a year, including the risk of fraud and changes to the company’s activities |
CC4 Monitoring activities | Regular reviews of controls, internal audits, monitoring and rectification of control deficiencies |
CC5 Control activities | Documented procedures, segregation of duties, controls associated with identified risks |
CC6 Logical and physical access | Multi-factor authentication, access reviews, staff onboarding and offboarding, encryption |
CC7 System operations | Logging and monitoring, vulnerability analysis, incident response |
CC8 Change management | Approval, testing and code review before changes go into production |
CC9 Risk mitigation | Supplier risk management, business continuity planning |
SOC 2 Type 1 vs Type 2: what’s the difference?
The two types of report address different issues:
SOC 2 Type 1 | SOC 2 Type 2 | |
|---|---|---|
What is assessed | Whether the controls have been designed appropriately | Whether the controls have been designed appropriately and implemented effectively |
Timeframe | A specific date | A review period, usually ranging from three to twelve months |
Evidence required by the auditor | Evidence that the controls exist and have been designed to meet the criteria | Evidence that the controls have been applied consistently throughout the entire period |
Typical use | An initial report or a rapid response to an initial request from a client | The report that most corporate buyers expect |
Corporate buyers tend to place greater importance on a Type 2 report, as it shows how the controls have performed over time, as well as how they were designed. There is no fixed minimum period for the review: the audit firm and the clients relying on the report decide what is acceptable. Which type to choose first depends on the stage you are at, your timetable and what is being asked of you:
Type 1 is often appropriate when you need to demonstrate the design of your controls at a specific point in time, for example, to respond to an urgent request from a client. Many organisations then move on to Type 2.
Type 2 is generally the most appropriate option when clients want evidence that your controls work in practice, and not just on paper.
What to expect for SOC 2 in 2027
The criteria themselves aren't changing. As of October 2026, the 2017 Trust Services Criteria described above are still in force, and the AICPA's pending proposals don't revise them. Two developments are worth knowing about as you plan your next audit:
New attestation standards are in the works, but not for 2027 audits. In February 2026, the AICPA's Auditing Standards Board proposed revisions to the attestation standards that SOC 2 examinations are performed under. They aren't final yet, and as proposed, they would apply to engagements beginning on or after 15 June 2029. Examinations in 2027 and 2028 will still follow the current standards.
AI is getting more attention in audits. There are no AI-specific criteria, but auditors increasingly look at AI systems and AI vendors under the existing criteria, such as risk assessment, access control, and vendor management. If AI is part of your product or your operations, expect questions about it in your next examination.
Why is SOC 2 important for businesses?
The value of SOC 2 depends on who you sell to and what they require. Where it's relevant, a SOC 2 report can:
Build customer trust with an independent opinion rather than self-assessment.
Shorten procurement and vendor assessments, since reviewers can often rely on the report instead of long questionnaires.
Give sales one consistent answer to security questions, instead of a new reply for every customer.
Demonstrate control maturity to customers, partners, and investors.
Reveal gaps in security and governance processes, often during the readiness phase, before the auditor finds them.
See how your SOC 2 preparation would run in Formalize
Bring your current control list and evidence, however scattered they are today. We'll show you how owners, policies, and evidence come together in one place before the auditor arrives.
How to prepare for SOC 2 compliance
Most of the effort in SOC 2 happens before the examination starts. A practical sequence looks like this:
Define your scope. Decide which services, systems, and locations the report covers.
Select the Trust Services Criteria. Security is required. Add others based on your services and customer commitments.
Map existing controls against the criteria. If you already work with ISO 27001, much of this mapping is a starting point rather than new work.
Identify and remediate gaps. Close missing or weak controls before the review period begins.
Assign control owners. Every control needs someone responsible for running it and keeping its evidence.
Establish evidence collection and monitoring. For Type 2, evidence has to cover the entire review period, so it needs to be captured as controls run, not reconstructed afterward.
Run a readiness assessment and choose your auditor. A readiness review, internal or with an advisor, shows whether your controls and evidence would hold up in front of an auditor. Only a licensed CPA firm can perform the examination itself.
Maintain controls after the report. A SOC 2 report doesn't formally expire, but buyers generally treat it as current for 12 months after the review period ends. Most organizations therefore renew it every year, so controls and evidence need to keep running between audits.
How long does it take to get SOC 2 compliant?
Two things set the timeline: how mature your controls already are and which report you need. For a first report, these are typical ranges:
Phase | Typical duration | What happens |
|---|---|---|
Readiness and remediation | One to three months, longer if you start from scratch | Scoping, gap assessment, closing gaps, setting up evidence collection |
Type 1 examination | A few weeks to two months | The auditor assesses control design at a specific date and issues the report |
Type 2 review period | Three to twelve months | Controls run and evidence is collected across the whole period |
Type 2 fieldwork and report | About one to three months after the period ends | The auditor tests how controls operated and issues the report |
Put together, a first Type 1 report often takes two to five months, and a first Type 2 report six months to a year, or longer if the review period runs a full year. Some CPA firms start testing during the review period, which shortens the wait at the end. From the second report on, the review period usually covers a full 12 months.
How Formalize supports SOC 2 preparation
Formalize doesn't replace your auditor. It organizes the work that leads up to the examination:
Controls with named owners and evidence attached, so you can show how each control ran throughout the review period.
Policies with approvals, versions, and acceptance tracking, supporting the policy-related controls in the security criteria.
Risk, incident, and supplier management in the same system as your controls.
A Trust Center to share your security documentation with customers.
If you also manage ISO 27001, NIS2, or the GDPR, that work can sit alongside your SOC 2 preparation.
Formalize itself is ISO 27001 certified and holds an ISAE 3000 Type 2 report, so we go through the same kind of independent assurance as the teams we support.