Is SOC 2 a certification?

SOC 2 results in an independent auditor’s assurance report, including for Type II. It is often called certification in marketing, but it is not a certificate like ISO 27001. A licensed CPA firm performs the examination. Guardera helps prepare your organisation for it.

Do we need Type I or Type II?

Agree the report type with the customers who will rely on it. Type I assesses control design at a given date. Type II also assesses whether those controls operated effectively throughout the defined reporting period.

Is SOC 2 the same as ISO 27001?

No, but the work overlaps. Policies and checks built for ISO 27001 help with SOC 2. SOC 2 also needs its own service description and, for Type II, proof that checks ran during the review period.

Is SOC 2 required by law?

No. SOC 2 is not a law or a regulation. Customers and partners ask for the report to see how you protect the data you hold for them.

What is the difference between SOC 1 and SOC 2?

SOC 1 covers the safeguards that affect your customers’ financial reporting. SOC 2 covers how you protect their data, checked against the Trust Services Criteria.

Do European customers ask for SOC 2?

Some do. SOC 2 comes from the AICPA, the US body for accountants. ISAE 3000, the international standard for auditors’ reports on subjects other than financial statements, can also cover an IT system’s safeguards. ISAE 3402, like SOC 1, covers safeguards that affect financial reporting.

Independent audit report

SOC 2: independent assurance for your customers

SOC 2 is an independent examination of controls protecting customer information in a service. Its report helps customers assess providers. Type I addresses control design at a point in time; Type II also evaluates operation over a period.

Plan SOC 2 preparation

For: Service and technology providers
Issued by: A licensed independent accounting firm
Type I: Control design at a given date
Type II: Control design and operating effectiveness over a period

Who it applies to

Services handling customer information

Software businesses asked for a SOC 2 report during a customer’s buying process.
Technology and service providers that hold or process other organisations’ data, or whose partners require an independent review.

The right report depends on your service and what your customer asked for.

What it asks of you

Prepare for the auditor’s examination

Describe the service being examined
Explain your systems, customer commitments and which Trust Services Criteria the report covers.
Assign responsibility for each control
Choose safeguards that match your service and record who performs and reviews them.
Keep dated reviews and approvals
Retain access reviews, change approvals and test records showing when checks happened.
Include suppliers in your review
Document outsourced services and which security responsibilities belong to each provider.
Resolve issues before examination
Check that safeguards work, carry out outstanding reviews and record their actual dates and results. Resolve findings before the audit and agree with the auditor how any gaps affect the reporting period.

How we help

Prepare your organisation for the SOC 2 audit

We agree the scope, assess control readiness and coordinate the work needed before the audit. We help your team implement improvements and maintain evidence of how controls operate. An independent accounting firm performs the examination.

Cybersecurity Audit & Risk AssessmentAn independent assessment of security and compliance, with risk-based findings and practical recommendations. ISO 27001 Certification ConsultancyBuild a working information security management system and prepare for independent ISO 27001 certification.

Common questions

Related regulations and standards

ISO 27001
An international standard you can be certified against, while SOC 2 ends in an auditor’s report. Safeguards built for one can support the other.

Free 30-minute call

Discuss your customer’s SOC 2 request

In a free 30-minute call, a senior specialist reviews the requested report and helps identify the preparation you need.

Plan SOC 2 preparation hello@guardera.tech