SOC 2 is the dominant assurance framework for technology and SaaS companies, particularly those serving US-headquartered customers. Where ISO 27001 is the global baseline, SOC 2 is the framework that customers in and around the US most often request and require as a condition of doing business. A SOC 2 report allows a service organisation to demonstrate its controls to many customers through a single, rigorous assessment, rather than each customer conducting its own security review — which is why so many SaaS vendors pursue it.
The Trust Services Criteria are the heart of the framework. Security (the common criteria) is required for every SOC 2 and covers the controls that protect systems and data — access control, network and system protection, change management, monitoring, risk mitigation. The additional criteria are optional and selected based on the service: availability covers whether systems are there when needed, processing integrity covers whether processing is complete and accurate, confidentiality covers whether protected information is kept confidential, and privacy covers personal-information handling. A service organisation selects the criteria relevant to its commitments and designs controls accordingly.
The Type I versus Type II distinction matters and is often misunderstood. A SOC 2 Type I is an attestation to the design of controls at a single point in time — it says the controls are designed appropriately to meet the criteria as of the audit date. A Type II is an attestation to the operating effectiveness of controls across a period — typically six to twelve months — meaning the auditor has tested that the controls actually operated as described throughout that period. Customers generally want a Type II, because design without operation is limited assurance, and many procurement requirements specify Type II explicitly.
The work to achieve SOC 2 is substantial but well-defined and substantially overlaps with ISO 27001. The organisation defines its system and the criteria it will commit to, conducts a gap analysis, designs and implements controls, documents everything, and then undergoes the audit. The evidence burden is significant — every control must be supported by evidence that it operated throughout the review period, which means continuous evidence collection rather than a one-time scramble before audit. This is why many organisations adopt a GRC platform to automate evidence collection, and why the same evidence base often supports both SOC 2 and ISO 27001.
Passeca supports SOC 2 Type I and Type II readiness, control design, audit preparation, and continuous monitoring. The engagement typically runs from scoping and gap analysis through control design and implementation, documentation, internal pre-audit, and coordination with the auditing firm. Passeca delivers this work on the Hyperproof GRC platform, which automates evidence collection across the control set and substantially reduces the ongoing burden of maintaining SOC 2 and other frameworks year over year.