Framework
SOC 2, the North American assurance report
Reviewed 6 October 2026
SOC 2
SOC 2 is an attestation report produced by an independent CPA firm against the AICPA Trust Services Criteria. It is not a certification and no certificate is issued. A Type I report assesses control design at a point in time; a Type II report tests operating effectiveness across an observation window, typically three to twelve months.
Definition
What is SOC 2?
SOC 2 reports on five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. Only Security, referred to as the Common Criteria, is mandatory. The other four are included where they are relevant to what the organisation promises its customers, and adding them expands the audit rather than strengthening it for its own sake.
The output is a report, not a badge. A SOC 2 report runs to tens of pages and contains the auditor's opinion, a description of the system, the controls tested and, critically, any exceptions found. Customers' security teams read it. A report with a clean opinion and three well-explained exceptions is normal; the exceptions are not automatically a problem, but they are visible.
SOC 2 has no prescribed control list. Unlike ISO 27001's Annex A, the organisation defines its own controls against the criteria, and the auditor tests what has been defined. That flexibility is genuinely useful and is also why two SOC 2 reports can describe very different levels of rigour.
Who SOC 2 applies to
- SaaS and technology companies selling to North American enterprise buyers, where SOC 2 is asked for by name.
- Service organisations handling customer data on behalf of others, which is the population the standard was written for.
- Companies whose procurement conversations have started stalling at the security review stage.
- Organisations already certified to ISO 27001 who need a second output for a different market.
The path
How long does SOC 2 actually take?
Realistic elapsed durations for an organisation starting without a dedicated compliance function. Elapsed time, not effort - the two are routinely confused when this gets scoped.
- 013-5 weeks
Readiness assessment
Decide which Trust Services Criteria are genuinely in scope, define the system boundary, and assess existing controls against the Common Criteria. Adding Availability or Privacy because it sounds thorough is the most common way to make the audit larger than it needed to be.
- 021-3 months
Remediate and define controls
Write the control descriptions the auditor will test, and close the gaps the readiness assessment found. Control descriptions matter more here than in ISO 27001, because the auditor tests exactly what has been written rather than a standard control set.
- 033-5 weeks
Type I report, if needed
A point-in-time opinion on whether controls are suitably designed. Often used to unblock a specific deal while the Type II window runs. It is a stepping stone rather than a destination, and sophisticated buyers know the difference.
- 043-12 months, then 4-8 weeks
Observation window and Type II
Controls must operate throughout the window, and the auditor samples evidence from across it. A three-month window is the usual first choice; twelve months is the steady state. Fieldwork and report drafting follow. Every control failure inside the window becomes a documented exception.
Cost and internal effort figures are being confirmed with the practice before publication: cost and effort figures · Q15
Failure points
Where SOC 2 programmes usually go wrong
Not the theory. The specific things that cause a delayed audit, a major non-conformity, or a certificate that does not survive its first surveillance visit.
Selecting more criteria than the business promises
Availability, Processing Integrity, Confidentiality and Privacy each add controls, evidence and cost. They belong in scope where they reflect a commitment made to customers. Included speculatively, they create exceptions against promises the business was never making.
Control descriptions written aspirationally
The auditor tests the control as described. A description saying access reviews occur monthly, where in practice they occur when someone remembers, produces an exception for every month missed inside the window. Describe what happens, then improve it - not the reverse.
Evidence that is not retrievable
Type II sampling asks for evidence from specific dates inside the window. Approvals made in a chat thread, tickets deleted on close, or logs with a thirty-day retention all fail this. Retention and retrievability need deciding before the window opens, not during fieldwork.
Starting the window before the controls are operating
The temptation is to open the observation window early to get the report sooner. Every week the controls are not operating properly is a week of exceptions in a report that customers will read. A slightly later start with clean operation produces a materially better report.
Onboarding and offboarding
The single most common source of exceptions. Access granted before approval, or not revoked promptly on departure, is easy for an auditor to test and hard to explain away. It is also the control enterprise security reviewers look at first.
Treating the report as the finish line
SOC 2 reports cover a window and go stale. Customers ask for a current report, which means the observation window is effectively continuous. Organisations that treat it as an annual project rediscover the same exceptions every cycle.
How we run it
SOC 2, delivered in sprints
- 01Scope set against what your contracts actually commit to, so you are not audited against promises you never made.
- 02Control descriptions drafted to match how your team really works, then improved - because the auditor tests the description.
- 03Evidence pipeline established before the observation window opens, including retention, so sampling cannot fail on retrievability.
- 04Onboarding and offboarding fixed first, since it is the highest-frequency source of exceptions in first-time reports.
- 05The window run with monthly checkpoints, so a control drifting is caught in week three rather than discovered at fieldwork.
- 06Auditor liaison handled throughout, including negotiating what constitutes acceptable evidence.
Choosing between them
SOC 2 or ISO 27001?
SOC 2 produces a report from a CPA firm; ISO 27001 produces a certificate from an accredited certification body. SOC 2 is what North American buyers ask for; ISO 27001 is what UK and European buyers ask for. SOC 2 lets the organisation define its own controls against broad criteria, which is flexible but means the reader has to actually read the report. ISO 27001 tests against a defined Annex A, which is more prescriptive but makes the certificate meaningful at a glance. The evidence work overlaps by roughly seventy per cent, so running both is far less than twice the effort - and if you sell on both sides of the Atlantic, you will eventually be asked for both.
ISO 27001FAQ
SOC 2: questions people actually ask
What is the difference between SOC 2 Type I and Type II?
How long does SOC 2 take?
Is SOC 2 a certification?
Do exceptions in a SOC 2 report mean we failed?
Can a UK company get SOC 2?
Start
Three ways in, depending on how close the deadline is.
- Book it
Book a discovery call
Thirty minutes, no deck. We work out whether there is a real engagement here, and say so if there is not.
- Go
Check the EU AI Act applies
Six questions, a dated list of the obligations that reach you, and a calendar file so the deadlines land somewhere you will see them again.
- Go
Request a roadmap
You know the obligation and the deadline. We scope the sprints, the deliverables and the dates.
Or just email a human: hello@cloudgap.ai
We reply within24 hours