Buyers use SOC 2 to judge your security without walking into your office.

Customers need reassurance that their data is safe with you. A SOC 2 is what an outside auditor concludes after checking your controls against published criteria. You hand it to customers rather than answering the same questions over and over.

Spelled out: System and Organization Controls 2, an auditor's report on controls in the areas of security, availability, processing integrity, confidentiality or privacy.

Software companies that sell to other businesses usually meet SOC 2 when a buyer's security reviewer wants it on the table before a contract is signed. Security is always covered; a company can also opt for Availability, Processing Integrity, Confidentiality or Privacy where customers care about them. The report goes deep: your system description, your controls and, in a Type 2, the auditor's tests and any exceptions. That depth is both its strength and its limit. It is written for informed readers, so it travels under a non-disclosure agreement, and it describes a period that has already passed rather than promising the future.

An enterprise security questionnaire

Plenty of questions can be answered by citing the matching control in the report.

The procurement stage of a sale

The buyer's vendor risk team asks for your newest report and reads the opinion and any exceptions.

A trust centre or data room

Customers and prospects can download the report once they accept an NDA.

Master services agreements

Contract clauses frequently oblige the supplier to keep a valid SOC 2 report in place year after year.

ISO 27001

ISO 27001 leads to a certificate from an accredited certification body for a management system. SOC 2 is an auditor's opinion, with no certificate.

SOC 3

A SOC 3 uses the same criteria but leaves out the detail, so it can be published openly.

• Decide which categories beyond Security your customers really need.
• Draw the system boundary: products, infrastructure, people and vendors in scope.
• Run a readiness assessment before choosing the observation period.
• Plan how you will share the report: NDA, trust centre, and who answers follow-up questions.

• GuideWhat is SOC 2?The attestation, the five categories, Type 1 vs Type 2, in plain words.
• GuideA SOC 2 attestation, explainedWhat an attestation is, who may give one, and what you may call the result.
• GuideHow to read a SOC 2 reportFive questions to ask of any report, and where each answer sits.

Sources: AICPA SSAE 18, AT-C section 105 and AT-C section 205; AICPA SOC 2 guide; AICPA TSP section 100, 2017 Trust Services Criteria (revised points of focus, 2022); DC 200 description criteria.