SOC 2 Compliance Services
For service organisations whose customers demand trust-services assurance — security, availability and confidentiality — under the AICPA framework.
SOC 2 (System and Organization Controls 2) is an independent assessment of a service organisation's security and related controls. It is performed by a licensed Certified Public Accountant (CPA) firm using the Trust Services Criteria developed by the American Institute of Certified Public Accountants (AICPA). Passeca runs readiness, control design, implementation and the observation period, then introduces you to a CPA firm — building evidence in Hyperproof so the same work also closes ISO 27001.
What is SOC 2?
SOC 2 is an auditing procedure developed by the American Institute of Certified Public Accountants (AICPA). It evaluates a service organisation's information-security controls against the Trust Services Criteria (TSC): Security (which is mandatory), Availability, Processing Integrity, Confidentiality and Privacy. It is the dominant assurance framework requested by US-based and global enterprise customers of SaaS, cloud and technology vendors.
There are two report types. A SOC 2 Type I report describes the controls you have designed and confirms they are suitably designed at a single point in time. A SOC 2 Type II report goes further: it confirms those controls actually operated effectively over a defined period of at least three months. Only a licensed CPA firm can issue either report. SOC 1 covers controls over financial reporting and SOC 3 is a public-summary version of SOC 2 for general distribution.
Who needs SOC 2?
- Your US enterprise customers may expect a SOC 2 report. SOC 2 is the default in American SaaS procurement and security questionnaires.
- You are a SaaS, cloud or technology vendor. It is the fastest way to demonstrate trust-services assurance to many buyers at once.
- You host or process customer data. Availability and Confidentiality categories prove you protect it.
- A prospect sent a 200-question security questionnaire. A SOC 2 Type II report is often the single artefact that satisfies it.
What does SOC 2 actually require?
SOC 2 is assessed against the AICPA Trust Services Criteria. The Security category (the Common Criteria) is mandatory and contains nine control families referenced as CC1 through CC9. The other categories are optional and selected based on the commitments you make to customers.
- CC1 — Control environment — governance, board oversight, organisational structure and ethics.
- CC2 — Communication and information — internal and external information flow and system descriptions.
- CC3 — Risk assessment — identifying and managing risks to the achievement of objectives.
- CC4 — Monitoring activities — ongoing and separate evaluations of control performance.
- CC5 — Control activities — the policies and procedures that mitigate identified risks.
- CC6 — Logical and physical access — access provisioning, authentication, MFA, and physical security.
- CC7 — System operations — change management, vulnerability management and incident response.
- CC8 — Change management — authorising, testing and approving system changes.
- CC9 — Risk mitigation — business continuity, backups and vendor management.
If you add Availability, Confidentiality or Privacy, additional criteria apply (the "A", "C" and "P" criteria). The auditor tests that each selected control is designed (Type I) and, for Type II, that it operated effectively throughout the period.
How Passeca gets you SOC 2 ready
- 01
Readiness assessment
We assess your environment against the Trust Services Criteria and identify the controls you need for the categories you are being audited against (typically Security plus Availability, Confidentiality or Processing Integrity).
- 02
Control design & roadmap
We design the missing controls and build a remediation roadmap with owners and dates. We decide Type I (point-in-time design) vs Type II (operating effectiveness over a period) with you based on what your customer is asking for.
- 03
Implementation & evidence
We implement the controls and capture evidence continuously in Hyperproof — policies, access reviews, change tickets, monitoring — so the auditor can test an operating control, not just read a document.
- 04
Pre-audit & observation period
For Type II, we run a pre-audit and then manage the 3–12 month observation period during which the controls must operate, with monthly evidence health checks to catch gaps before the auditor sees them.
- 05
CPA-firm audit & report
We introduce you to a licensed CPA firm (a SOC 2 report can only be issued by one), support the fieldwork, and manage responses to any exceptions until the report is issued.
What you get from the engagement
How long does SOC 2 certification take?
| Report type | Typical duration |
|---|---|
| Type I | 2–4 months |
| Type II (short) | 6–8 months |
| Type II (standard) | 9–12 months |
Type I is the fastest route to a report in hand and is often used to satisfy an urgent customer while a Type II observation period runs in the background. Starting from an existing ISO 27001 ISMS can compress both.
Doing more than one framework?
| SOC 2 | ISO 27001 | |
|---|---|---|
| Risk assessment | ||
| Access control (CC6 / A.5.15) | ||
| Change management (CC8 / A.8.32) | ||
| Incident response (CC7.4 / A.5.26) | ||
| Monitoring / logging | ||
| Vendor management | ||
| Mandatory management system | No | |
| Issuer | CPA firm | ISO body |
| Coverage | ~80% overlap | ~80% overlap |
SOC 2 and ISO 27001 share roughly 80% of their controls. Building evidence once in Hyperproof lets you satisfy both audiences with one body of work — the most common combination for SaaS and technology vendors serving US and EU enterprise customers.
SOC 2 compliance, answered
What is a SOC 2 report?
What is the difference between SOC 2 Type I and Type II?
How long does SOC 2 certification take?
Who can issue a SOC 2 report?
Do I need SOC 2 if I already have ISO 27001?
Which Trust Services Criteria should I include?
Does SOC 2 expire?
Book a Free 30-Minute SOC 2 Consultation
Tell us whether you're considering a Type I or Type II report and what your customers require. We'll discuss your current readiness, outline the next steps and provide initial timeline and cost estimates.
Related