Everything you need to know about SOC 2 Type I and Type II, from scoping through to audit and certification.
SOC 2 has become the de facto trust standard for technology companies selling to enterprise customers, particularly in North America. If your prospects are asking for it, or if you want to close deals faster, this guide covers everything you need to know, from understanding the framework to achieving and maintaining certification.
SOC 2 (System and Organisation Controls 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It evaluates how a service organisation manages customer data across five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Unlike prescriptive standards such as ISO 27001, SOC 2 is flexible, organisations define their own controls and the auditor assesses whether those controls are suitably designed (Type I) and operating effectively over time (Type II). This flexibility is both a strength and a challenge: there is no single checklist to follow.
A SOC 2 Type II report is increasingly required by enterprise procurement teams as evidence that a vendor takes data security seriously. Without it, deals can stall or fail entirely at the security review stage.
SOC 2 Type I is a point-in-time assessment. The auditor evaluates whether your controls are suitably designed as of a specific date. It is faster to achieve, typically 2 to 4 months, and useful for early customer assurance while you build your observation period.
SOC 2 Type II covers a period of time, typically 6 to 12 months. The auditor evaluates whether your controls not only exist but operate effectively throughout the observation period. This is the report most enterprise customers require, as it demonstrates sustained security practice rather than a one-time snapshot.
Most companies pursue Type I first to demonstrate intent, then move to Type II once they have operated controls for the required observation period.
Scoping is one of the most important decisions in your SOC 2 journey. The scope defines which systems, services, and Trust Service Criteria are included in the audit. A narrower scope means fewer controls to implement and a faster, cheaper audit, but it must accurately reflect what your customers care about.
The Security criterion (also called the Common Criteria) is mandatory for all SOC 2 reports. The other four criteria, Availability, Processing Integrity, Confidentiality, and Privacy, are optional and should be included only if they are relevant to your service commitments.
Most SaaS companies start with Security only, then add Availability and Confidentiality as customer requirements evolve. Adding Privacy is increasingly common for companies handling personal data in regulated industries.
The most time-consuming part of SOC 2 is evidence collection. Auditors require documented evidence that each control operates as described, access logs, change management records, security training completions, vendor assessments, and more.
Automated compliance platforms such as Drata and Vanta can significantly reduce the burden of evidence collection by integrating with your cloud infrastructure, identity providers, and development tools to collect evidence continuously.
Preparation for the audit itself involves working with your auditor to agree the scope, provide system descriptions, and respond to information requests. A well-prepared evidence package can reduce audit duration and cost significantly.
Logical and physical access controls, system operations, change management, and risk mitigation. Mandatory for all SOC 2 reports.
System availability and performance commitments as agreed with customers, monitoring, incident response, and disaster recovery procedures.
Complete, valid, accurate, timely, and authorised system processing, particularly relevant for financial and transactional systems.
Protection of information designated as confidential, encryption, access controls, and disposal procedures.
Collection, use, retention, disclosure, and disposal of personal information in accordance with your privacy commitments and applicable law.
Evaluate your current security posture against the Trust Service Criteria, identifying gaps and prioritising remediation before the formal audit begins.
Implement required controls, policies, procedures, technical safeguards, and evidence collection workflows, with guidance from your compliance manager.
A point-in-time assessment confirming controls are suitably designed. Useful for early customer assurance while you build your observation period.
SOC 2 Type II requires a minimum 6-month observation period demonstrating controls operate effectively over time.
Your chosen AICPA-licensed CPA firm conducts the formal audit. Evidence packages are prepared and auditor queries are managed on your behalf.
You receive your SOC 2 Type II report, a detailed attestation you can share with customers, prospects, and partners.
Netru methodology