SOC 2 by industry
SOC 2 by industry: what each sector usually scopes in.
The framework is the same everywhere; what buyers press on differs by sector. For twelve industries, this guide lists the categories usually added beyond Security, and the controls that tend to draw the most scrutiny. Use it as a starting point, not a rule.
Back to SOC 2 services01 · Software & platforms
Software and platform companies
Most first SOC 2 reports come from here, usually Security with Availability and Confidentiality.
- SaaS & cloud
- Usually adds Availability and Confidentiality. Scrutiny: tenant isolation, production access, change management.
- Developer tools & APIs
- Usually adds Availability. Scrutiny: API authentication, secrets handling, the release pipeline.
- Data & analytics platforms
- Usually adds Confidentiality, sometimes Processing Integrity. Scrutiny: data access, pipeline accuracy, retention.
- AI companies
- Usually adds Confidentiality; Privacy where individuals' data is used. Scrutiny: how customer data trains or reaches models, and who can see it.
02 · Money & transactions
Fintech, e-commerce and HR tech
Where processing errors cost money, Processing Integrity comes into play.
- Fintech & payments
- Usually adds Processing Integrity, Availability and Confidentiality. Scrutiny: reconciliations, change control, privileged access. Cardholder data also brings PCI DSS.
- E-commerce
- Usually adds Availability, sometimes Privacy. Scrutiny: payment flows, customer data, uptime at peak.
- HR & payroll tech
- Usually adds Confidentiality, Processing Integrity and sometimes Privacy. Scrutiny: payroll accuracy, employee data access. Some buyers also need SOC 1.
03 · Services & operations
Service providers and operations
When you hold standing access to clients' systems, access control is the whole story.
- MSPs & IT services
- Usually adds Availability and Confidentiality. Scrutiny: privileged access to client environments, technician offboarding, remote tools.
- Consulting & advisory
- Usually adds Confidentiality. Scrutiny: client data on laptops, document sharing, access when engagements end.
- Logistics & supply chain
- Usually adds Availability and Processing Integrity. Scrutiny: integrations with partners, data accuracy, continuity.
04 · Regulated data
Healthtech and edtech
SOC 2 sits beside sector laws here; it never replaces them.
- Healthtech
- Usually adds Confidentiality and often Privacy. Scrutiny: access to health data, logging. Health data also brings HIPAA, which SOC 2 does not satisfy on its own.
- Edtech
- Usually adds Privacy and Availability. Scrutiny: student data access, parental and school commitments, retention.
A SOC 2 can describe controls that also support HIPAA, GDPR or PCI DSS, but it is not a compliance opinion on any of them.
05 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
- SOC 2 for SaaS and cloud companiesMulti-tenant data, the shared stack, and what buyers ask first.
- SOC 2 for fintechMoney movement, partner banks and processing integrity.
- SOC 2 for AI companiesTraining data, model providers and customer prompts.
- SOC 2 for healthtechWhere SOC 2 sits beside HIPAA, and the categories it leans on.
- SOC 2 for e-commerce platformsMerchant data, payment flows and peak-load availability.
- SOC 2 for MSPs and IT service providersPrivileged access into other people's systems.
- SOC 2 for edtechStudent data, school buyers and consent.
- SOC 2 for HR and payroll techEmployee records, payroll accuracy and access separation.
- SOC 2 for consulting and professional servicesClient data held on laptops, email and shared drives.
- SOC 2 for data analytics companiesIngested data, pipelines and what customers can query.
- SOC 2 for developer toolsSource code, secrets and CI/CD as customer data.
- SOC 2 for logistics and supply chain softwareShipment data, integrations and partner portals.
More about SOC 2 by industry
Does our industry change what SOC 2 requires?
No. It changes what buyers press on.
The Trust Services Criteria are the same for everyone. Industry shapes which categories you've promised, and which controls reviewers read most closely.
We're in healthtech. Is SOC 2 enough?
No; HIPAA applies separately.
If you handle protected health information for US healthcare clients, HIPAA applies on its own terms. Many healthtech vendors hold a SOC 2 and run a HIPAA program; the controls overlap.
Scope for your sector, not a template.
A SOC 2 readiness assessment sets categories and controls around what your buyers actually ask for.