An independent report your customers can rely on
What SOC 2 is
SOC 2 (System and Organization Controls 2) is an auditing framework created by the AICPA. An independent CPA firm examines how a service organisation protects customer data against the Trust Services Criteria and issues a report that customers can rely on. A SOC 2 report is an attestation report, not a certificate. Readiness is the work you do before the audit: choosing the scope, closing control gaps and gathering evidence so the audit goes smoothly.
Two report types
- Type 1 reports on whether your controls are suitably designed at a single point in time.
- Type 2 reports on whether your controls are suitably designed and operated effectively over a period, commonly 3 to 12 months.
What a SOC 2 readiness engagement gives you
- A defined scope: the system, services, locations and Trust Services Criteria in the report
- A gap report against the criteria, with a prioritised fix list
- Policies, procedures and evidence processes ready for the auditor
- A clear plan and calendar for Type 1, the Type 2 observation period and audit
A SOC 2 report is issued by an independent CPA firm. It is not a certificate and does not guarantee that a breach will never occur.
Key terms in plain language
- 01Service organisation
- The company whose controls are examined, such as a SaaS or hosting provider
- 02Service auditor
- The licensed CPA firm that performs the examination and writes the report
- 03Trust Services Criteria (TSC)
- The AICPA criteria used to evaluate controls: security, availability, processing integrity, confidentiality, privacy
- 04System description
- Management’s written description of the services, infrastructure, software, people, data and procedures in scope
- 05Management assertion
- Management’s statement that the description is fair and the controls meet the criteria
- 06Observation period
- The window a Type 2 report covers
- 07Exception
- A control that did not operate as described in a tested sample
- 08Subservice organisation
- A vendor, such as a cloud host, whose services support your system
- 09Bridge letter
- Management’s note covering the gap between the end of the report period and today
Answer enterprise security questions once
A SOC 2 report answers the security questions that enterprise buyers ask before they sign.
Faster sales cycles
One independent report replaces many repeated security questionnaires.
Access to enterprise deals
Many larger buyers require a SOC 2 report from vendors that handle their data.
Independent proof
A licensed CPA firm, not you, states whether controls meet the criteria.
Stronger security posture
Gaps in access, change, monitoring and vendor management are found and fixed.
Clear, documented operations
Policies, owners and evidence replace informal habits.
Lower risk of incidents and disputes
Consistent controls reduce the chance and impact of breaches.
Reusable foundation
Controls map to ISO 27001, ISO 27701 and other frameworks, so later audits are easier.
Investor and partner confidence
Shows operational maturity during due diligence.
Continuous improvement
Annual reporting keeps controls current as the business changes.
Who needs SOC 2, and which report to choose
Any organisation that stores, processes or has access to customer data on a customer’s behalf is a candidate.
From start-ups to platform providers
Procurement and security review teams increasingly ask for SOC 2 before they sign. If your first enterprise deals depend on a report, readiness is where to begin.
| Audience | Why it fits |
|---|---|
| SaaS and cloud software providers | Customers ask for SOC 2 during procurement and security review |
| Data centre, hosting and managed service providers | Operate infrastructure that customers depend on |
| Fintech and payments platforms | Handle financial data and face strict vendor due diligence |
| Healthtech and life sciences platforms | Process sensitive data for regulated customers |
| Outsourcing, BPO and support providers | Access customer systems and personal data |
| AI, analytics and data platforms | Customers want assurance over data handling and access |
| Start-ups moving upmarket | First enterprise deals often depend on a report |
Type 1 versus Type 2
The timings below are typical ranges, not rules; the AICPA does not set a minimum observation period.
| Aspect | Type 1 | Type 2 |
|---|---|---|
| What the auditor tests | Whether controls are suitably designed | Whether controls are suitably designed and operated effectively |
| Period covered | A single date | A period, commonly 3 to 12 months |
| Evidence | Policies, configurations, screenshots on that date | Samples from across the whole period, such as access reviews, tickets, logs |
| Typical total time | About 2 to 4 months | About 6 to 15 months including the observation period |
| Level of assurance | Lower: shows the right controls exist | Higher: shows they worked over time |
| Typical use | First report, urgent deal, or checkpoint before Type 2 | What most enterprise buyers ask for; renewed yearly |
| Cost | Lower | Higher, because of the longer period and more testing |
Which should you choose?
- Choose Type 1 first if a deal needs something quickly, or you want to test your control design before the longer audit.
- Go straight to Type 2 if you can run at least a 3-month observation period and your customers specifically ask for it.
- After the first Type 2, most organisations repeat it every year with a 12-month period.
Do these sound familiar?
- 1Do customers send security questionnaires?
- 2Are enterprise deals stalled on security review?
- 3Do you handle customer data in the cloud?
Two or more “yes” answers mean a SOC 2 readiness assessment is a sensible next step.
Book a free SOC 2 readiness assessmentFrom goals and scope to annual renewal
A first SOC 2 Type 2 report usually takes 6 to 15 months end to end, including the observation period (a typical range that depends on readiness and the period you choose).
-
01 Goals and scope Confirm why you need the report, which customers ask for it, which services and systems are in scope, and whether you start with Type 1 or go straight to Type 2.
-
02 Choose Trust Services Criteria Security is always included. Add availability, processing integrity, confidentiality or privacy only if your customers and commitments call for them; extra criteria add testing and cost.
-
03 Gap assessment Compare current practices with each selected criterion. Output: a gap report and a prioritised remediation plan.
-
04 Risk assessment Identify risks to your commitments and systems, rate them, and link each to controls.
-
05 Policies and procedures Write and approve the policies the criteria expect, such as information security, access control, change management, incident response, vendor management and business continuity.
-
06 Remediate and implement controls Close gaps in areas auditors test most, including access control and multi-factor authentication, user access reviews, change management, logging and monitoring, encryption, backup and recovery, vulnerability management, onboarding and offboarding, and vendor oversight.
-
07 Evidence and ownership Assign an owner to every control, decide how evidence is captured, and set up regular collection, ideally automated.
-
08 Select the auditor Engage a licensed CPA firm that is independent of your readiness work; agree scope, criteria and the observation window.
-
09 Readiness review Run a mock audit or internal check; fix findings before the observation period or the Type 1 date.
-
10 Type 1 audit (optional) The auditor tests control design at a single date and issues the report, typically within a few weeks of fieldwork.
-
11 Type 2 observation period Controls must operate as described every day of the period (commonly 3 to 12 months; 6 months is typical for a first report). Collect evidence monthly and review exceptions quickly.
-
12 Type 2 fieldwork and report After the period ends, the auditor samples evidence from across it, discusses exceptions with management and issues the report.
-
13 Maintain and renew Repeat annually with a 12-month period, and issue bridge letters to customers for any gap between report periods.
Naming an observation period start date before every control is actually operating. Controls not in place at the start cannot be tested for that period, so finish remediation first.
Five criteria, one of them mandatory
SOC 2 is built on five Trust Services Criteria. Security is mandatory in every report; the other four are chosen based on what you promise customers.
| Criterion | What it covers | Include when |
|---|---|---|
| Security (Common Criteria, required) | Protection against unauthorised access and misuse, across governance, risk, monitoring, access, operations, change management and vendors | Always |
| Availability | The system is available for operation and use as committed | You have uptime or service level commitments |
| Processing integrity | Processing is complete, valid, accurate, timely and authorised | You process transactions or calculations for customers |
| Confidentiality | Information designated confidential is protected | You hold customers’ confidential business data |
| Privacy | Personal information is collected, used, retained, disclosed and disposed of as committed | You process personal information on behalf of customers |
What the Security criteria test (Common Criteria CC1 to CC9)
| Group | Focus |
|---|---|
| CC1 | Control environment: integrity, oversight, accountability, competence |
| CC2 | Communication and information |
| CC3 | Risk assessment |
| CC4 | Monitoring of controls |
| CC5 | Control activities and policies |
| CC6 | Logical and physical access |
| CC7 | System operations, detection and incident response |
| CC8 | Change management |
| CC9 | Risk mitigation, including vendors and business disruption |
Mapping to other frameworks (indicative)
| Framework | Relationship to SOC 2 |
|---|---|
| ISO/IEC 27001 | Large overlap in controls; ISO 27001 is a certification of an information security management system, SOC 2 is an attestation report, and many organisations hold both |
| ISO/IEC 27701 | Overlaps with the SOC 2 Privacy criterion and personal data controls |
| ISO 31000 | Supports the SOC 2 risk assessment criteria |
| ISO 22301 | Supports availability and business continuity controls |
| PCI DSS and sector frameworks | Separate requirements; SOC 2 does not replace them, though controls overlap |
| SOC 1 | Reports on controls relevant to customers’ financial reporting, not security |
| SOC 3 | A shorter public version of a SOC 2 style report that can be shared openly |
Documents and records auditors expect
SOC 2 does not publish a fixed document list. The auditor tests your controls against the criteria you chose, and policies and evidence are how you show them. Your auditor confirms what applies to your scope.
| Document or record | Purpose | Type 1 | Type 2 |
|---|---|---|---|
| System description (management’s description of the system) | Defines services, infrastructure, software, people, data, procedures and boundaries | Yes | Yes |
| Management assertion letter | Management’s statement on the description and controls | Yes | Yes |
| Information security policy | Sets security direction and commitments | Yes | Yes |
| Access control policy and procedures | Provisioning, review and removal of access | Yes | Yes |
| Change management policy and procedure | Approval, testing and release of changes | Yes | Yes |
| Incident response plan | Detection, escalation, communication and review of incidents | Yes | Yes |
| Risk assessment and risk register | Identified risks, ratings, owners and treatments | Yes | Yes |
| Vendor and third-party management policy and vendor list | Due diligence and monitoring of subservice organisations | Yes | Yes |
| Business continuity and disaster recovery plan | Recovery commitments and testing | Yes | Yes |
| Data classification, retention and disposal policy | Handling of confidential and personal information | If in scope | If in scope |
| HR security: background checks, onboarding and offboarding, acceptable use | Staff screening, agreements and access removal | Yes | Yes |
| Security awareness training records | Evidence staff are trained | Policy and plan | Completion records for the period |
| User access review records | Periodic review of who has access to what | Process defined | Completed reviews across the period |
| Change tickets and approvals | Evidence changes followed procedure | Sample as of date | Samples across the period |
| Logs, alerts and monitoring evidence | Shows detection and response work | Configuration | Retained logs for the whole period |
| Vulnerability scans and penetration test reports | Evidence of testing and remediation | Latest report | Reports and remediation across the period |
| Backup and restore test records | Evidence recovery works | Configuration | Test results for the period |
| Incident log and post-incident reviews | Record of incidents and follow-up | Process defined | All incidents in the period |
| Subservice organisation reports (for example your cloud host’s SOC 2) | Reliance on vendors’ controls | Yes | Yes |
| Management review and meeting minutes | Evidence of oversight | Yes | Across the period |
How the audit works, and keeping the report current
The audit is carried out by an independent licensed CPA firm. Your readiness provider prepares you but does not issue the opinion.
Independent by design
If we provide readiness services, the audit itself is performed by a separate, independent auditor. The audit opinion is issued by that CPA firm, not by QMet.
| Phase | What happens | Typical outcome |
|---|---|---|
| Scoping and kickoff | Agree system boundary, criteria, report type and period | Engagement letter and plan |
| Information request | Auditor lists the policies, configurations and evidence needed | Evidence portal or shared folder populated |
| Fieldwork | Auditor tests design (Type 1) or samples operation across the period (Type 2), with walkthroughs and interviews | Tested controls, any exceptions noted |
| Exception review | Management reviews exceptions and adds responses | Agreed wording in the report |
| Draft report | Auditor shares the draft for factual accuracy | Draft reviewed and corrected |
| Final report | Auditor signs and issues the opinion | Report delivered |
| Renewal | New period begins, usually back to back and annual | Continuous coverage |
What the report contains
| Section | Content |
|---|---|
| Independent service auditor’s report | The auditor’s opinion on the description and controls |
| Management’s assertion | Management’s statement on the description and controls |
| System description | Services, infrastructure, software, people, data, procedures, and subservice organisations |
| Criteria, controls and tests | Each criterion, your controls, and for Type 2 the auditor’s tests and results |
| Other information (optional) | Management responses to exceptions or additional detail |
Possible opinions
- Unqualified: controls meet the criteria; exceptions may still be listed.
- Qualified: a significant issue affects part of the criteria.
- Adverse or disclaimer: serious failure or insufficient evidence.
Sharing and maintaining the report
- SOC 2 reports are usually restricted-use documents. Share them with customers and prospects under a non-disclosure agreement.
- Customers normally want the most recent report, commonly covering the last 12 months, so plan back-to-back annual periods.
- Issue a bridge letter when there is a gap between the end of the report period and the customer’s request.
- Keep controls running between audits and review them after changes in systems, vendors or staff.
Typical timeline and cost
- Type 1 audit: about 2 to 4 months from start to report (typical range).
- Type 2 observation period: 3–12 months, agreed with the auditor.
- Auditor fees are quoted by the CPA firm. Our readiness fees are scoped to your organisation; request a quote after the free assessment.
Questions we hear most about SOC 2
Talk to a QMet consultant and we will answer it directly, with no obligation.
Ask your question01 What is SOC 2?
An auditing framework from the AICPA. An independent CPA firm examines your controls against the Trust Services Criteria and issues a report for your customers.
02 Is SOC 2 a certification?
No. It is an attestation report with the auditor’s opinion, not a certificate that an organisation holds.
03 What is the difference between Type 1 and Type 2?
Type 1 checks that controls are well designed at one date. Type 2 checks that they are well designed and worked over a period, commonly 3 to 12 months.
04 Which one do customers want?
Most enterprise buyers prefer Type 2, but a Type 1 report can help you start conversations while the Type 2 period runs.
05 Do we need all five Trust Services Criteria?
No. Security is required. Add the others only if your commitments to customers call for them.
06 How long does it take?
Type 1 is typically about 2 to 4 months. A first Type 2 report typically takes 6 to 15 months in total, depending on your readiness and observation period.
07 How often do we renew?
Annually, with back-to-back periods so customers always see a recent report.
08 Can the readiness provider also do the audit?
No. The audit must be performed by an independent CPA firm.
09 Does a SOC 2 report replace ISO 27001?
No. They are different: SOC 2 is an attestation report and ISO 27001 is a management system certification. Many organisations hold both, and their controls overlap.
Ready to win enterprise customers with a SOC 2 report?
Book a free SOC 2 readiness assessment. We will help you choose the report type and criteria, find the gaps and plan the road to your auditor.
By submitting a request you agree to our Privacy Policy. Name, work email, company, headcount and report type interest are all we need to start.
Disclaimer: This page is for general information and does not constitute audit, legal or professional advice. SOC 2 is an AICPA framework; QMet is not affiliated with the AICPA. Audit opinions are issued only by independent licensed CPA firms. Readiness services do not guarantee an audit outcome.