SOC 2 in plain words: for European and UK companies selling to the US
US customers often ask for a SOC 2 report before they sign. Here's what it is, the difference between Type 1 and Type 2, who can issue it, and what you need in place, whether you're in Lyon, Munich or Leeds.
In 30 seconds
- What
- An examination of the controls of a service organisation, relevant to security, availability, processing integrity, confidentiality or privacy. The result is a report with the auditor's opinion.
- Criteria
- The AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022. You and your auditor agree which categories the report covers.
- Two types
- Type 1: your system description and the design of your controls, at one date. Type 2: the same, plus whether the controls worked throughout a period.
- Who issues it
- A licensed CPA firm, under the AICPA's attestation standards. You receive an attestation report with the firm's opinion.
- Who sees it
- Restricted use: customers and others who understand your system, usually under NDA. SOC 3 is the short public version.
- Your part
- Management describes the system and asserts that it's accurate. Your team runs the controls and keeps the evidence for the whole period.
What SOC 2 is
SOC 2 is a US attestation report. A CPA firm examines how a service organisation protects the systems it uses to serve its customers, against the Trust Services Criteria set by the AICPA, the US accounting profession’s body. The result is a report: a description of your system, your controls, the auditor’s opinion and, for Type 2, the tests the auditor ran.
US companies use it to check their suppliers. If you host data, run a platform or provide IT services to US customers, expect it in their vendor review, next to their security questionnaire.
The Trust Services Criteria
The criteria are grouped in five categories. You and your auditor agree which ones the report covers, based on your service and what your customers need.
Privacy in SOC 2 is a separate topic from GDPR. A SOC 2 report with the Privacy category doesn’t show GDPR compliance, and GDPR doesn’t ask for SOC 2. If you sell to US customers from Europe, you’ll often have both to handle.
Type 1 or Type 2
Type 1
Your system description and the design of your controls, as of a specified date.
- Question answered
- Are the right controls in place?
- Evidence
- At one date
Type 2
The same opinions, plus one on whether the controls operated effectively throughout a specified period.
- Question answered
- Did they work, month after month?
- Evidence
- For the whole period
Who issues the report
Only a CPA firm can perform a SOC 2 examination and issue the report, under the AICPA’s attestation standards (SSAE 21 applies to reports dated from 15 June 2022). A software tool can’t. When you pick a firm based outside the US, ask how it’s licensed to issue SOC 2 reports.
The report goes to specified parties who understand your system: your customers, their auditors, sometimes prospects under NDA. For a short version you can publish, the auditor issues a SOC 3 report.
What you need in place
- A defined scopeThe service, the systems behind it, the criteria covered.
- A system descriptionWhat the service does, and the systems, people and procedures behind it, written by management.
- Risk assessmentYour risks for that service, and how controls answer them.
- Policies people followSecurity, access, change management, incident response, suppliers.
- Access controlOnboarding, offboarding, MFA, periodic access reviews.
- Change managementChanges requested, reviewed, approved and traced.
- Monitoring and incidentsLogs reviewed, incidents recorded and handled.
- Evidence over timeFor Type 2: records for every month of the period.
- FirstReadinessScope, gap analysis, missing controls and policies.
- DateType 1The auditor checks the design at one date.
- PeriodType 2Controls run and evidence builds up over the agreed period.
- ThenRenewalCustomers ask for a recent report, so the cycle repeats.
SOC 2 and ISO 27001
They cover much of the same ground: risk assessment, access control, change management, incidents, suppliers, monitoring. The AICPA has published a mapping between the Trust Services Criteria and ISO 27001 (published in 2018, before the 2022 edition of ISO 27001), so one set of controls can serve both.
The deliverables differ. ISO 27001 gives you a certificate from an accredited certification body, on a management system, valid three years with surveillance audits. SOC 2 gives you an attestation report from a CPA firm, describing your system and, for Type 2, the controls’ results over a period. Ask each customer which one they accept before you start the second.
Getting ready for SOC 2: who does what
What QoBot does
- Helps you set the scope: which service, which systems, which criteria the customer needs.
- Drafts the system description from what's true in your company today.
- Maps your existing controls, including ISO 27001 ones, to the Trust Services Criteria and lists the gaps.
- Writes the missing policies and procedures, and the evidence list for each control.
- Follows the evidence through the Type 2 period and tells you what's missing before the auditor does.
What your team does
- Management approves the scope, the system description and the assertion.
- Your team runs the controls and keeps the records, every month of the period.
- You choose the CPA firm and agree the period with it.
- You answer the auditor's requests and sample tests.
Proposed scope for Northwind Logistics: the shipment-tracking platform, Security and Availability criteria, a Type 1 first. 31 controls mapped from your ISO 27001 system, 6 gaps. This week:
- Claire (COO): approve the scope and the system description outline · ~20 minNeeds you
- Tom (IT): export last quarter's access reviews and change tickets · guide ready · ~30 minYour turn
FAQ
Can a European or UK company get a SOC 2 report?
Yes. SOC 2 is about your service and your controls, wherever you're based. The report is issued by a CPA firm; ask the firm how it's licensed to issue SOC 2 reports, as the AICPA refers unlicensed firms to state boards of accountancy.
Type 1 or Type 2 first?
A Type 1 shows the design of your controls at a date, so it can come sooner. A Type 2 also shows they worked through a period, which is what many customers want. Ask your customer which one they accept, and whether a Type 1 now with a Type 2 planned is enough for the contract.
How long does it take?
It depends on your scope and on what's already in place. For a Type 2, your controls must run through the whole period before the report can cover them, and the period is agreed with your auditor. Plan in months.
We have ISO 27001. Do we still need SOC 2?
If a customer asks for it, usually yes: they're different deliverables. Much of the work overlaps, and the AICPA has published a mapping between the Trust Services Criteria and ISO 27001, so your ISO controls give you a strong start. See ISO 27001 in plain words.
Can we share our SOC 2 report publicly?
No. A SOC 2 report is for specified parties who understand your system, so it's usually shared under NDA. For a public version, auditors issue a SOC 3 report.
Can QoBot issue or sign our SOC 2 report?
No. Only a CPA firm can perform the examination and issue the report. QoBot gets you ready: scope, system description draft, controls mapped to the criteria, evidence list and follow-up.
Sources
- 2017 Trust Services Criteria (with revised points of focus, 2022)AICPA · security, availability, processing integrity, confidentiality, privacyOfficial text
- SOC 2 guide: reporting on an examination of controls at a service organizationAICPA · what a SOC 2 examination covers; SSAE 20 and 21Official text
- System and Organization Controls: SOC suite of servicesAICPA · SOC reports are performed by CPAs; unlicensed firms referred to state boardsOfficial page
- SOC 3: SOC for service organizations, general useAICPA · general use reports that can be freely distributedOfficial page
- Mapping of the 2017 Trust Services Criteria to ISO 27001AICPA · May 2018, updated March 2020, before ISO/IEC 27001:2022Official page
- Explaining the 3 faces of SOCJournal of Accountancy (AICPA) · type 1 and type 2 reportsOfficial page
- Promises of fast and easy threaten SOC credibilityJournal of Accountancy (AICPA), February 2026 · CPAs only; SOC 2 restricted useOfficial page
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error