SOC 2 readiness, from scope to a clean report.
We scope your system against the Trust Services Criteria, close the gaps, and build the evidence an independent CPA firm tests for your SOC 2 Type 1 or Type 2 report.
- First SOC 2:
- a readiness assessment and a roadmap to your first report.
- Already reporting:
- evidence discipline for the next period, and exception follow-up.
- Scope and Trust Services Categories agreed in writing up front
- Controls mapped to the Security common criteria, CC1 to CC9
- Evidence built the way a CPA firm samples it
- Mapped to ISO 27001, HIPAA and the frameworks you already run
What is SOC 2, and what does the report prove?
SOC 2 (System and Organization Controls 2) is an attestation framework from the AICPA. An independent licensed CPA firm examines how a service organization protects customer data and issues a report with its opinion. It is a report, not a certificate, and no law requires it: buyers do.
Your controls
- Access & identity
- Change management
- Monitoring & incidents
- Vendor management
- Backup & recovery
- Policies & training
The criteria
- Trust Services Criteria
- Security · always
- Availability
- Confidentiality
- Processing Integrity
- Privacy
SOC 2
An attestation report
A CPA firm's opinion on whether your controls meet the criteria you chose. Type 1 looks at their design on one date; Type 2 tests whether they operated across a period.
Enterprise buyers usually ask for Type 2, because it shows the controls actually ran, not just that they existed.
The five Trust Services Categories
Security
Always in scope. The common criteria CC1–CC9: governance, risk, access, operations, change and vendor risk.
Availability
Add it when you promise uptime: capacity, monitoring, backup and disaster recovery.
Confidentiality
Add it when contracts bind you to protect confidential information: classification, encryption, retention, disposal.
Processing Integrity
Add it when customers rely on processing being complete, accurate and timely: payments, payroll, billing.
Privacy
Add it when you make promises to individuals about their personal information. The heaviest category.
Where SOC 2 is asked for most
- SaaS & cloud
- Fintech & payments
- Healthtech
- MSPs & IT services
- AI & data platforms
- HR & payroll tech
The trigger is rarely a regulator. It is a security review that stalls a deal, or a vendor questionnaire that ends with “please attach your SOC 2 report”. Our industry guide shows what each sector usually scopes in.
Browse the full SOC 2 guide library: criteria, timeline, audit preparation, reading the reportWho needs a SOC 2 report?
Any service organization that holds or processes customer data, when its buyers ask for independent assurance. One SOC 2 examination answers many customers at once, instead of each one auditing you.
01 · Your customers
Review your security
- Enterprise security teams
- Procurement & vendor risk
- Their own auditors
- US and global buyers
Ask for your SOC 2 report, usually Type 2, under NDA.
02 · Your organization
The service organization
- SaaS & cloud platforms
- Managed service providers
- Data processors
- Fintech infrastructure
Examined by an independent licensed CPA firm against the Trust Services Criteria.
03 · Your vendors
Subservice organizations
- Cloud hosting
- Payments & email
- Support & monitoring tools
Usually carved out, and monitored through their own SOC reports.
If prospects send security questionnaires that end with a request for your SOC 2, it has become commercially mandatory for you.
Your report also describes the vendors you rely on, called subservice organizations. Most are carved out: their controls are not tested in your report, so you monitor them through their own reports. And it lists complementary user entity controls (CUECs): what your customers must do on their side.
How a SOC 2 readiness program works
Six phases, each with a named output and a clear ask of your team. The SOC 2 readiness assessment covers the first two. The SOC 2 readiness program runs all six, up to and through the CPA firm's examination.
- Scope
Scoping & Trust Services Categories
We decide which Trust Services Categories your commitments call for, draw the system boundary (products, infrastructure, people, data), list your subservice organizations, and help you choose Type 1 or Type 2 and an independent CPA firm.
- Category selection
- System boundary
- Subservice orgs
- Type 1 or Type 2
- You get
- A scope document, the categories in scope and a Type 1 / Type 2 plan.
- You provide
- Your customer contracts and SLAs, an architecture walkthrough, and a named compliance owner.
- Assess
Readiness assessment
We compare your current controls with the criteria in scope, map what already exists, and rank each gap by the risk it leaves and the evidence it would cost you at audit.
- Control mapping
- Gap analysis
- Evidence review
- Remediation roadmap
- You get
- A readiness report, a control matrix mapped to CC1–CC9 and a ranked roadmap.
- You provide
- Access to your policies, tickets and tool configurations, and time with system owners.
- Remediate
Controls, policies & system description
We close the gaps with your team: access reviews, MFA, logging, change management, vendor reviews, written policies, and a first draft of the system description your report will contain.
- Policies
- Technical controls
- Vendor management
- System description draft
- You get
- Controls in place, approved policies, and a system description draft.
- You provide
- Engineering time for changes, and sign-off on each policy.
- Operate
Observation period (Type 2)
For a Type 2, your controls run through the observation period the CPA firm will test. We keep evidence collecting from day one: access reviews, change tickets, scans, backups and incidents, so nothing is missing when samples are drawn.
- Evidence calendar
- Access reviews
- Change records
- Monthly checks
- You get
- An evidence calendar and a period with no gaps for the auditor to sample.
- You provide
- Control owners who run each control on schedule.
- Review
Pre-examination review
Before fieldwork, we test your controls the way a CPA firm samples them, fix what would become an exception, organize the evidence package, and finalize the system description and management assertion.
- Readiness review
- Evidence package
- System description
- Management assertion
- You get
- An evidence package indexed by control, and a list of fixes made.
- You provide
- Owners available to walk through their controls.
- Examine
Examination support & renewal
The independent CPA firm performs fieldwork and issues the report. We support you through auditor requests, help write management responses to any exceptions, and plan the next period so coverage never lapses.
- Fieldwork support
- Exception responses
- Bridge letter
- Next period plan
- You get
- Support until the report is issued, and a plan for the annual cycle.
- You provide
- Fast answers to auditor requests during fieldwork.
No one-size timeline: it depends on your scope, your starting controls and the observation period you choose. You get a firm timeline in writing before work starts.
What you receive
Everything the program produces lands in one evidence file. Each item is paired with the question a CPA firm or a customer's reviewer asks about it.
Each gap comes with the specific fix and a walkthrough with your engineers. We verify each fix and update the matrix, so closure is documented before the auditor arrives.
Only an independent licensed CPA firm can examine your controls and sign a SOC 2 report. We prepare you; the firm that attests must be independent of us.
01, Scope phase: Scope document & category selection
The system boundary, the categories in scope with the commitment behind each, and your subservice organizations.
02, Assess phase: Readiness report & control matrix
Every control mapped to CC1–CC9 and any added categories, with gaps ranked by risk.
03, Remediate phase: Policies & procedures
Approved policies for access, change, incidents, vendors, backup and more, written for how you work.
04, Remediate phase: System description draft
Services, infrastructure, software, people, procedures and data, drafted against DC 200.
05, Operate phase: Evidence calendar
Every recurring control with its frequency, owner and where its evidence lives.
06, Operate phase: Vendor & subservice register
Critical vendors, their SOC reports, review dates and the CSOCs you rely on.
07, Review phase: Evidence package
Evidence indexed by control, with complete populations ready for the auditor's samples.
08, Review phase: Management assertion draft
The written assertion your leadership signs, aligned to the system description.
09, Examine phase: Exception responses & next-period plan
Root cause and fix for any exception, and the plan that keeps coverage continuous.
Illustrative example, not client data
What one control looks like in the matrix
- Control
- Quarterly user access review for production systems
- Criteria
- CC6.2, CC6.3
- Frequency
- Quarterly
- Population
- Every in-scope system, every quarter
- Evidence
- Full user list reviewed, dated sign-off, tickets proving removals
- Owner
- Head of IT
Four common SOC 2 misconceptions
Each one is common, reasonable, and the reason security reviews stall.
Assumption 01
Assumption: We'll get a SOC 2 certificate.
What SOC 2 actually means
There is no SOC 2 certificate and no certification body. You get an attestation report with a CPA firm's opinion, covering a stated system and period. Saying “certified” makes careful reviewers doubt the rest of your answers.
Assumption 02
Assumption: A clean SOC 2 report means we're secure.
What SOC 2 actually means
A clean (unmodified) opinion gives reasonable assurance, not absolute, about the controls you described, against the criteria you chose, for one past period. It is strong evidence, not a guarantee.
Assumption 03
Assumption: Our cloud provider has SOC 2, so we're covered.
What SOC 2 actually means
The provider's report covers its own layer. Your configuration, access, data handling and the CUECs its report assigns to you remain yours, and your own customers will ask for your report.
Assumption 04
Assumption: Any exception in the report means we failed.
What SOC 2 actually means
SOC 2 has no pass mark. Exceptions are individual test deviations in Section 4; the opinion weighs them. Many reports with a few exceptions still carry a clean opinion.
Heard one of these from your team or a buyer? A SOC 2 readiness assessment shows what your report will really say.
Get a SOC 2 readiness assessmentWhat you can hold us to.
We don't publish client logos or case studies; we keep our clients' security posture private. These are the commitments we make instead.
Our commitments
Experienced practitioners lead
Every engagement is led by experienced practitioners.
Peer review
Every deliverable is peer-reviewed before it reaches you.
Written scope and change control
You know what is covered, and what happens if scope changes, before work starts.
Controls your team can run
Controls built for how you operate, that generate their own evidence after we leave.
Auditify Security made our SOC 2 compliance journey so much easier. They provided expert advice, and their team was with us every step of the way — we passed the audit with flying colors.
Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.
Ask for a referenceSOC 2 questions buyers ask
Is there a SOC 2 certificate?
No. SOC 2 produces an attestation report, not a certificate.
SOC 2 is an attestation: an independent licensed CPA firm examines your controls and states its opinion in a report covering a specific system and period. There is no certificate, no certificate number and no register of “certified” companies. Describe it accurately: the report type, the period and the CPA firm.
Everything about SOC 2, explained in plain words.
Every SOC 2 guide we publish, grouped by the question you're asking: what it is, how to scope it, how the engagement runs, how to read the report, and how to use it in sales. Two interactive tools let you try your scope and dissect a sample report.
Start here08
- What is SOC 2?The attestation, the five categories, Type 1 vs Type 2, in plain words.
- Is there a SOC 2 certificate?No. What to say instead, and how to verify a vendor's claim.
- SOC 2 Type 1 vs Type 2Snapshot or period, the observation window, and moving between them.
- SOC 1 vs SOC 2 vs SOC 3Who asks for each report, how the three differ, and when you need two.
- SOC 2 vs ISO 27001One access review followed through both audits, and what each reviewer asks.
- Who can sign a SOC 2 report?Only a licensed CPA firm, independent of whoever built your controls.
- A SOC 2 attestation, explainedWhat an attestation is, who may give one, and what you may call the result.
- Your first framework: SOC 2 or ISO 27001?A decision path by market, buyer and team.
Scope & criteria12
- Trust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
- Scope & the system boundaryWhat's in, what's carved out, and the CUECs your customers own.
- Writing the system descriptionA drafting workflow for the description, from facts to a review loop.
- The SOC 2 controls listNo official list. Example controls grouped by the team that owns them.
- SOC 2 scope emulatorSwitch your commitments and data on and off; see which categories they pull in.
- Hosting on a SOC 2 cloud: what you inheritWhat a provider's report covers, and the controls that stay yours.
- Carve-out or inclusive: how vendors appear in your reportTwo ways to present a vendor, and what each does to your report.
- Picking categories beyond SecurityWhich of the five categories your customers actually need.
- Confidentiality and Privacy: the pair people confuseCompany data against personal information, and when each applies.
- Several products, one report?Drawing a system boundary when you sell more than one product.
- Subservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
- Complementary controls: what customers and vendors owe the systemCUECs and CSOCs, written so they can actually be checked.
The five categories05
- The Security category, criterion by criterionCC1 to CC9 in plain words, with the evidence each invites.
- The Availability categoryA1.1 to A1.3: capacity, protection and tested recovery.
- The Confidentiality categoryC1.1 and C1.2: identifying, protecting and disposing of confidential data.
- The Privacy categoryP1 to P8: notice, choice, collection, use, access, disclosure, quality, monitoring.
- The Processing Integrity categoryPI1.1 to PI1.5: complete, valid, accurate and timely processing.
Running the engagement14
- SOC 2 timeline & roadmapThe seven phases from scoping to the annual cycle.
- SOC 2 audit preparationThe auditor's request list, complete populations, and a dry run before fieldwork.
- SOC 2 compliance checklistChecks grouped by who has to act, with the record that proves each.
- Ten SOC 2 pitfallsThe predictable mistakes in scoping, the period and fieldwork.
- Sampling & deviationsPopulations first, how samples are picked, and what one miss means.
- Pen tests & recovery testsNo criterion demands either. Your own control wording does.
- An incident during the periodWhy an incident is not automatically an exception, and what to disclose.
- Continuous monitoring & year twoMonitoring as a criterion, a calendar of control frequency, and early signs of drift.
- SOC 2 on a small teamWhat you can simplify, and what no team size excuses.
- Changing systems mid-auditHow the observation period copes with migrations, tools and people.
- From a Type 1 report to a Type 2What carries over, what is tested again, and what to start logging.
- The readiness assessment, step by stepWhat it produces, what it doesn't, and how to use the result.
- Who owns each SOC 2 controlA role map from engineering to HR to leadership.
- Choosing the length of the observation periodThe trade-offs between a short and a long Type 2 window.
Evidence & testing03
Reading the report11
- How to read a SOC 2 reportFive questions to ask of any report, and where each answer sits.
- SOC 2 report X-rayClick through a sample report: 18 markers, one question each.
- Opinions & exceptionsThe path from one failed sample up to the opinion a report carries.
- Does SOC 2 mean you are secure?Reasonable assurance, what the report proves, and what it doesn't.
- Inside a SOC 2 report, section by sectionWho writes each section, and what each one is for.
- Auditor independenceThe line between helping you and auditing you.
- The management assertionWhat leadership is signing, and what backs it.
- Choosing a CPA firm for SOC 2Qualifications, peer review, and the questions worth asking.
- A scorecard for a vendor's SOC 2 reportTen checks that tell a useful report from a thin one.
- Can a firm outside the US issue a SOC 2?CPA licensing and affiliation, with India as the worked case.
- Getting a SOC 2 as a company based in IndiaWhat changes, what doesn't, and how to choose the examiner.
Selling with SOC 210
- SOC 2 in sales & questionnairesWhat the report answers, what it can't, and what to say mid-journey.
- Sharing your SOC 2 reportRestricted use, NDAs, prospects, and when a SOC 3 fits.
- Do your vendors need SOC 2?Tier vendors by reach, and accept the right evidence per tier.
- SOC 2 and GDPR, HIPAA, DPDPWhere SOC 2 overlaps each law, and where it stops.
- SOC 2 by industryWhat twelve sectors usually scope in, and what gets scrutinised.
- SOC 2 and security questionnairesWhat each one settles, and how to answer without repeating yourself.
- How long a SOC 2 report stays usefulThe age buyers accept, and what to do when yours ages out.
- SOC 2 bridge lettersWhat a bridge letter says, who signs it, and its limits.
- Your second SOC 2: renewal and the continuous cycleBack-to-back periods, what year two repeats, and what it adds.
- “SOC 2 in progress”: what you can honestly sayWording that is true at each stage, and wording to avoid.
SOC 2 by industry12
- SOC 2 for SaaS and cloud companiesMulti-tenant data, the shared stack, and what buyers ask first.
- SOC 2 for fintechMoney movement, partner banks and processing integrity.
- SOC 2 for AI companiesTraining data, model providers and customer prompts.
- SOC 2 for healthtechWhere SOC 2 sits beside HIPAA, and the categories it leans on.
- SOC 2 for e-commerce platformsMerchant data, payment flows and peak-load availability.
- SOC 2 for MSPs and IT service providersPrivileged access into other people's systems.
- SOC 2 for edtechStudent data, school buyers and consent.
- SOC 2 for HR and payroll techEmployee records, payroll accuracy and access separation.
- SOC 2 for consulting and professional servicesClient data held on laptops, email and shared drives.
- SOC 2 for data analytics companiesIngested data, pipelines and what customers can query.
- SOC 2 for developer toolsSource code, secrets and CI/CD as customer data.
- SOC 2 for logistics and supply chain softwareShipment data, integrations and partner portals.
AT-C & AICPA standards07
- The AICPA attestation standards, mappedHow SSAE 18, the AT-C sections and the SOC suites fit together.
- AT-C 105: ideas behind every attestationPractitioner, subject matter, criteria, assertion: the vocabulary of every report.
- AT-C 205: how an examination is runPlanning, testing and reporting on an examination engagement.
- AT-C 320: the SOC 1 standardControls at a service organization that touch financial reporting.
- SSAE 18: what the codification didWhy the standards were recodified, and what changed for service organizations.
- DC 200: what a system description is measured againstThe description criteria, and how an auditor tests a description.
- TSP 100: how the criteria document is builtCategories, criteria and points of focus, and why the 2017 set still applies.
SOC 1: understanding it07
- SOC 1, explainedWhat a SOC 1 covers, AT-C 320, and bridge letters.
- Who is who in a SOC 1The service organization, user entities and user auditors, and how a report moves between them.
- Who needs a SOC 1 report?A test for service providers whose work touches clients' financial statements.
- SOC 1 Type 1 vs Type 2Design at a date or operation over a period, and what auditors want.
- SOC 1 or SOC 2: which do you need?A decision path for service providers asked for either.
- SOC 1 and Sarbanes-OxleyHow a service provider's report feeds a client's SOX work.
- SOC 1 and ISO 27001A financial-controls report next to a security certificate.
SOC 1: what is inside07
- Control objectives in a SOC 1How to write them, and why they come before the controls.
- ICFR and SOC 1 controlsWhich controls matter to a client's financial reporting.
- The SOC 1 system descriptionWhat the description must say, and how it is tested.
- User entity controls in a SOC 1What clients must do for your controls to work.
- Subservice organizations in a SOC 1Carve-out or inclusive for the vendors behind your service.
- How to read a SOC 1 reportThe sections, the opinion, and the exceptions that matter.
- SOC 1 bridge lettersCovering the gap after a period ends, for a client's auditor.
SOC 1: getting one07
- Preparing for a SOC 1 examinationWhat to have ready before fieldwork starts.
- A SOC 1 readiness checklistA working list to test your position before you engage a CPA firm.
- SOC 1 phases from scoping to reportThe order of work, from scoping to the issued report.
- SOC 1 for payroll providersCalculation, cut-offs and file transfers a client's auditor tests.
- SOC 1 for fintech and paymentsMoney movement, reconciliations and settlement.
- SOC 1 for mortgage and loan servicingPayments, escrow and investor reporting.
- SOC 1 for BPO and outsourced accountingProcessing on behalf of a client's finance team.
SOC 303
The library index01
Know what your SOC 2 report will say, before the auditor writes it.
Send the basics
Your product and infrastructure, roughly how many people, what you promise customers, and any reports you already hold.
We scope the work
We respond within 24 hours, then agree the scope with you in writing.
Your SOC 2 readiness assessment
You get a readiness report, a control matrix and a roadmap to your first report.
- First SOC 2:
- a readiness assessment and a roadmap to your first report.
- Already reporting:
- evidence discipline for the next period, and exception follow-up.
We prepare you for the examination. The opinion and the report come from an independent licensed CPA firm.