Guides, scoping frameworks, and evidence playbooks that take you from first readiness assessment to a clean annual Type II — built from real attestation engagements.
A SOC 2 report describes your controls as they actually ran, not as your policies say they should.
SOC 2 is an attestation report, not a certificate. An independent CPA firm examines your controls against the AICPA's Trust Services Criteria and issues a restricted-use report that your customers read as part of due diligence.
For a UK firm selling to US enterprises, it is often the first document a procurement team asks for, and the deal waits until you have it.
Type 1 shows the design. Type 2 shows it working.
Security, covered by the Common Criteria, is in every SOC 2 report. Availability, Confidentiality, Processing Integrity and Privacy are added when your customers need them.
| Ref | Domain | Controls | Guides |
|---|---|---|---|
| CC | Security (Common Criteria) | 33 | Not yet covered |
| A | Availability | 3 | Not yet covered |
| C | Confidentiality | 2 | Not yet covered |
| P | Privacy | 18 | Not yet covered |
Every article in this vault maps to a stage of the attestation journey — start where you are.
Understand what the attestation proves before committing budget or timeline.
Choose your criteria, draw the system boundary, and close the gaps first.
Turn scoped criteria into owned, evidence-generating, operating controls.
Run fieldwork as a project — evidence pipeline, interviews, exceptions.
Keep contiguous annual windows, bridge letters, and scope under control.
Management signs the assertion in every SOC 2 report, so ownership sits at the top. A security or compliance lead runs the programme day to day.
Each control has an owner who produces its evidence throughout the observation period, not just before fieldwork.
The CPA firm is independent by design. It tests and reports on your controls; it can't build them for you.
The criteria themselves are in the matrix above.
Short answers to the questions we hear most from UK firms facing their first SOC 2 request.
SOC 2 is an attestation framework from the AICPA. An independent CPA firm reports on whether a service organisation's controls meet the Trust Services Criteria for security and, where in scope, availability, processing integrity, confidentiality and privacy.
Not formally. SOC 2 produces an attestation report, not a certificate, although "SOC 2 certified" is common shorthand. See what SOC 2 certification actually means.
Yes. The report has to be issued by a licensed CPA firm, and a number of them work with UK clients. Start with a readiness assessment before you engage one.
It runs in three phases: readiness, an observation period while your controls operate, and fieldwork and reporting by the CPA firm. The observation period is usually the longest part. See the SOC 2 audit.
ISO 27001 leads to a certificate against a management system standard. SOC 2 is an attestation report on controls against the Trust Services Criteria. The controls overlap heavily, so firms holding one can usually add the other with far less effort. See the compliance checklist starting from ISO 27001.
Every guide in one place. Filter by journey stage or domain.
Work with a Trust Architect to scope your criteria, build evidence-generating controls, and get audit-ready — without stalling your roadmap.