SOC 2 by industry

SOC 2 for consulting firms: when the system is your people and their laptops.

Q: Should we choose Confidentiality over Privacy?

Usually Confidentiality first. Client files are mostly business information under contract, which is what Confidentiality covers. Privacy is worth adding when the work routinely involves personal information you collect or handle under direct commitments to individuals.

A consulting firm doesn't ship a platform. Its "system" is consultants, the devices they carry, the shared drives and mailboxes where client files land, and the access clients grant into their own environments. That makes a SOC 2 harder to scope and easier to get wrong. This guide shows how to define the system so the report means something to the client reading it.

Back to SOC 2 services

01 · Who asks

Who asks consulting companies for a SOC 2 report

The buyer decides the scope and the weight of the report, so start with who is asking.

Asked by	What they want to see
Client procurement or third-party risk team	A Type 2 report before your consultants receive sensitive files or access to client systems.
Client's regulated business unit	How you meet the outsourcing or vendor rules their own regulator applies to them.
Client's general counsel	Whether privileged or deal-related documents stay inside a defined group and are destroyed at engagement end.
Prime contractor using you as a subcontractor	Assurance they can pass up the chain to their own client.

02 · What is in scope

What sits inside the system boundary

The report covers one system. In this sector the boundary usually takes in:

Consultant endpoints: Laptops and phones that hold client files, with their encryption, patching and remote-wipe status.
Collaboration suite: Email, chat and the shared drives where engagement folders live, with their sharing settings.
Engagement workspace: The per-client folder or data room, its membership and its end-of-engagement handling.
Access into client environments: Accounts and credentials clients issue to your staff, which you must request, track and give back.
Onboarding and offboarding: Hiring checks, confidentiality agreements and removal of access for consultants and contractors.

03 · Categories

Which Trust Services Categories matter here

Security is always in. The rest depend on what you promise customers.

Category	Weight in this sector	Why
Security	Always	Required; most of it here is device and identity control.
Confidentiality	Strong	Client documents are the asset clients care about, and they come with contractual handling and destruction terms.
Privacy	Sometimes	Relevant for HR, healthcare or customer-research work where you handle personal information directly.
Availability	Rarely	Clients seldom depend on your systems being up; they depend on your people.
Processing Integrity	Rarely	Only where you operate a process for the client, such as a managed reporting run.

04 · Vendors in the report

The vendors that appear in your report

Each one is a subservice organization or a carve-out, and the report has to say which.

Collaboration and email provider: Usually carved out; your configuration of it (sharing rules, retention, admin roles) stays in scope.
Device management service: Carved out, with your enrolment and compliance-policy controls tested.
Freelancers and subcontracted consultants: Not subservice organizations in the usual sense; treat them as personnel under your onboarding and access controls, or describe them explicitly.
Secure file transfer or data room provider: Name it if client files move through it, and keep its report on file.

05 · Sector controls

Controls that this sector makes necessary

Examples only. Your own wording is what the auditor tests.

S.1
Engagement folder membership reviewThe engagement lead confirms who can open each client folder at set intervals and at every staffing change.
S.2
External sharing restrictionsClient folders cannot be shared outside the firm except through an approved, logged method.
S.3
Engagement close-outAt engagement end, client files are returned or destroyed as the contract says and client-issued accounts are surrendered; a close-out record is kept.
S.4
Managed device requirementClient data may be opened only on enrolled devices with encryption and screen lock enforced.
S.5
Client credential registerEvery account a client issues to a consultant is recorded, with owner and expiry, so it can be returned.
S.6
Contractor equivalenceFreelancers sign the same confidentiality terms and follow the same device rules as staff.

06 · Traps

Where companies in this sector slip

Predictable, and cheaper to fix before fieldwork.

Describing the firm instead of a system. A description that reads like a company profile fails the description criteria. Define the service and its components.
Forgetting client-issued accounts. If a consultant leaves and still holds a login to a client's environment, your offboarding failed even if your own systems are clean.
Personal devices for "just email". Mail carries attachments. A bring-your-own-device exception quietly widens the boundary.
No proof of destruction. Contracts promise it; auditors sample ended engagements and ask for the record.
Scoping out subcontractors. If they touch client data, leaving them out makes the report misleading to the client.

07 · Where client data lives

Mapping where a client's files actually go

Before scoping, trace one engagement's documents from arrival to destruction.

Where it should be

Controlled locations

The engagement folder on the managed drive
The client's own environment, through issued accounts
An approved data room for large transfers

Where it tends to drift

Uncontrolled copies

Downloads folders on consultant laptops
Attachments in personal or forwarded mail
Chat threads and meeting recordings
Notes apps and personal cloud storage

The report can only cover the left column. Controls should pull files back from the right one, or prevent them reaching it.

Download controls on managed drives. Restrict or log downloads of client folders to unmanaged devices.
Mail retention and forwarding rules. Block automatic forwarding to outside addresses.
Recording policy. Say where meeting recordings are stored and when they're deleted.
Leaver device return. Wipe and return checks before the final day, with a record.

08 · Evidence

Evidence to have ready

What an auditor will ask for, in the order they usually ask.

System description naming the service, the tools and the people in scope
Device inventory with encryption and enrolment status
Folder membership reviews for a sample of engagements
Close-out records for engagements that ended in the period
Client credential register with returns for leavers
Signed confidentiality agreements for staff and contractors
External sharing settings and the log of approved exceptions

Your client's vendor rules travel to you

Clients in regulated sectors often must oversee their service providers under their own rules; in the US, for example, the FTC Safeguards Rule asks covered financial institutions to select and monitor service providers that can protect customer information. Your SOC 2 is one piece of evidence for that oversight. It does not make you, or them, compliant with that rule.

Sources: AICPA Trust Services Criteria (TSP section 100, 2017, revised points of focus 2022), including C1.1 and C1.2; AICPA description criteria (DC section 200); AICPA SOC 2 guide; US FTC Standards for Safeguarding Customer Information (16 CFR Part 314).

More about SOC 2 for consulting

Is a ten-person advisory firm too small for SOC 2?

No, but the system must be defined tightly.

A small firm can be examined if it describes a real service and its components. The controls lean on the collaboration suite and device management, which small teams can run well.

Our consultants work inside the client's systems. Whose controls are those?

Mostly the client's.

The client controls its own environment. What is yours is how you request, use and give back access, and how your people behave. The report should say so plainly, often as a complementary user entity control.

Do we need a SOC 2 if clients already send us their own questionnaire?

Not always; it depends on volume.

With a handful of clients, questionnaires may be enough. When several ask for the same assurance, one report answers them all and cuts repeat work, though some will still send follow-up questions.

Should we choose Confidentiality over Privacy?

Usually Confidentiality first.

Client files are mostly business information under contract, which is what Confidentiality covers. Privacy is worth adding when the work routinely involves personal information you collect or handle under direct commitments to individuals.

Scope your consulting SOC 2 around what buyers ask.

A readiness assessment turns this into your boundary, your categories and your gaps.

Get a SOC 2 readiness assessment Book a free consultation Back to SOC 2 services