Getting a SOC 2 when your company is based in India.

• The criteria. The Trust Services Criteria apply as written, with Security in every report.
• Scope logic. You define the system boundary around what you promise customers, not around your office location.
• The description. Your system description is measured against the same description criteria (DC 200).
• The examination. Type 1 or Type 2, walkthroughs, populations, samples and an opinion.

1. 1Examiner selectionUS customers will usually expect a US-licensed CPA firm to sign. See our page on firms outside the US for how local teams take part.
2. 2Time zonesAgree walkthrough windows that overlap your engineers' day and the examiner's, and name a single coordinator.
3. 3Data residencySay plainly in the description which regions hold customer data, and why. Buyers will ask.
4. 4Sub-processorsList every vendor that touches customer data, local and global, and decide how each appears as a subservice organization.
5. 5Buyer expectationsUS security reviewers read the report against their norms: named tools, clear boundaries, current period.
6. 6Local vendorsSome Indian vendors may not hold a SOC 2. Plan alternative monitoring, such as questionnaires, ISO 27001 certificates or contract terms.

Privacy law context

If you process personal data in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules apply alongside SOC 2. SOC 2 doesn't certify compliance with the DPDP Act. If you add the Privacy category, expect the description and controls to reflect what you actually commit to under both.

Indian cybersecurity directions on incident reporting and log retention may also shape controls you already run. Where they do, describe the control as it really operates, so the examiner tests what exists.

• Can a firm outside the US issue a SOC 2?CPA licensing and affiliation, with India as the worked case.
• SOC 2 and GDPR, HIPAA, DPDPWhere SOC 2 overlaps each law, and where it stops.

1. Confirm the signing entity by name and check it in a US state board licence search and the AICPA peer review file.
2. If an Indian firm is involved, ask how it relates to the US firm and what part of the work each does.
3. Ask how the firm runs remote fieldwork and which hours its team works.
4. Ask about experience with your cloud regions and with companies serving US customers from India.
5. Ask the firm to state scope, period and categories in writing in its proposal.

• Choosing a CPA firm for SOC 2Qualifications, peer review, and the questions worth asking.

1. 01

   Scope with your buyers in mind

   Draw the boundary around what US customers buy.

   What happens

   • List products, regions and data flows
   • Decide categories from customer commitments

   You get

   • A written scope statement
   • A category decision

   Good practice

   • Regions named explicitly

   Watch for

   • Scoping by office rather than by system

2. 02

   Map vendors and data

   Every sub-processor, local and global.

   What happens

   • Collect vendor reports or alternatives
   • Note data residency per system

   You get

   • A vendor register
   • A data location map

   Good practice

   • Monitoring planned for vendors with no SOC 2

   Watch for

   • Leaving local payment or HR vendors off the list

3. 03

   Close the gaps

   Controls and evidence that an examiner can sample.

   What happens

   • Run a gap assessment
   • Write policies people actually follow

   You get

   • A control matrix
   • An evidence calendar

   Good practice

   • Evidence kept in the systems that do the work

   Watch for

   • Policies copied from templates and never used

4. 04

   Engage the examiner

   Signing firm confirmed, period agreed.

   What happens

   • Shortlist and score firms
   • Agree walkthrough hours

   You get

   • An engagement letter
   • A fieldwork plan

   Good practice

   • One coordinator on your side

   Watch for

   • Signing before you know who signs the report

Please confirm current licensing, privacy and regulatory points with the AICPA, your examiner and your own legal adviser. This page is general guidance, not legal advice.

Sources: AICPA SSAE, AT-C sections 105 and 205; AICPA guide SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA DC section 200; TSP section 100 Trust Services Criteria (2017, revised points of focus); Digital Personal Data Protection Act, 2023 (India); CERT-In Directions under section 70B of the Information Technology Act, 2000.