SOC 2 certification: what you actually get and the route to your first report

A US prospect's security team has sent the vendor form, and one line reads "please attach your SOC 2 certification". The deal is waiting on it, and you are not sure what to commit to. This guide is for founders, COOs and security leads at UK B2B tech firms with 25 to 100 staff, many of whom already hold or are pursuing ISO 27001.

The short answer is that there is no SOC 2 certificate. What you receive is an attestation report from an independent, licensed CPA firm. This guide explains what that means, what you hand the customer, and the route to your first report in the order you take it.

Is there such a thing as SOC 2 certification?

No. SOC 2 certification is the common name for a SOC 2 report: an attestation issued by an independent, licensed CPA firm under AICPA attestation standards. The report gives an opinion on your controls against the Trust Services Criteria. The route runs readiness, a Type 1 or Type 2 choice, the examination, the report, then the same again each year.

The Journal of Accountancy, the AICPA's own journal, describes SOC reports as examinations performed by CPAs under the AICPA's Statements on Standards for Attestation Engagements. The same article notes that "compliance" is a term never used in SOC 2 examinations.

What you receive is a SOC 2 attestation: a document, signed by the CPA firm, that a customer reads. There is no certificate, no certificate number and no register entry. The hub page on SOC 2 covers what the framework is and the five criteria categories it can address.

A SOC 2 report is an opinion, not a badge.

The criteria themselves come from the AICPA. Its 2017 Trust Services Criteria are control criteria set by the AICPA's Assurance Services Executive Committee for use in attestation engagements. Your controls are measured against them, and your system is described using the AICPA's separate description criteria.

How is a SOC 2 report different from an ISO 27001 certificate?

A SOC 2 report is an attestation by a CPA firm that describes your system, your controls and, for a Type 2, how they operated over a period. An ISO 27001 certificate is issued by an accredited certification body after auditing your management system. One is a detailed report shared privately; the other is a certificate anyone can verify.

UKAS describes certification as third-party confirmation, via audit, of an organisation's systems. UKAS accredits the certification bodies that do that auditing, and its free CertCheck database lets anyone verify a UKAS-accredited management system certificate.

SOC 2 sits outside that structure entirely. No UKAS-accredited certification body issues it, and nothing about it appears on CertCheck.

The detail is the point. A SOC 2 report shows a customer how you run your controls; an ISO 27001 certificate tells them an accredited body has checked that you run them.

What should you tell a customer who asks for your SOC 2 certificate?

Tell them you can provide a SOC 2 report rather than a certificate, and name its type and the period or date it covers. Send it under a non-disclosure agreement, because SOC 2 reports are restricted-use. If they need something they can share freely, a SOC 3 report or your ISO 27001 certificate does that job.

The restriction is not a formality. According to the AICPA's journal, SOC 2 reports are restricted to specified parties who understand the service organisation's system and the services it provides.

A short, accurate reply usually lands better than a scramble. Something like this works:

• If you have a report: "We hold a SOC 2 Type 2 report covering [period]. We can share it under NDA."
• If you are on the route: "We are preparing for our first SOC 2 examination, with a report expected by [month]. Meanwhile, here is our ISO 27001 certificate and its scope."
• If they need something public: "Our SOC 3 report and ISO 27001 certificate can be shared without an NDA."

The AICPA's SOC 3 page explains that SOC 3 reports address the same subject matter as SOC 2 but without the same level of detail, so they are general use reports and can be freely distributed. That makes SOC 3 the version for a website or a trust centre.

How do you get SOC 2 certification?

You get SOC 2 certification, meaning a SOC 2 report, in five steps: assess your readiness and close the gaps, choose a Type 1 or Type 2 report, engage a licensed CPA firm for the examination, receive and share the report, then repeat each year. Readiness comes first because the examination tests what already exists.

Each step has its own decisions. Here is the SOC 2 certification process as one map:

1. Readiness. Define the system and services in scope, map your controls to the Trust Services Criteria, and close the gaps before anyone is paid to test them. A SOC 2 readiness assessment sets out the method.
2. Type 1 or Type 2. Choose the report type your customer will accept. The comparison of Type 1 and Type 2 covers the trade-offs and the observation period.
3. The examination. A licensed CPA firm tests your controls against the criteria. Management also provides a written assertion about the system description and the controls.
4. The report. You receive the CPA firm's report, including its opinion and, for a Type 2, the tests it ran and their results. You share it with customers under NDA.
5. The annual cycle. Customers expect a current report, so the examination repeats. A bridge letter from management can cover the gap between one report period and the next.

The difference between the two report types matters most at step 2. A Journal of Accountancy explainer sets it out: a Type 1 report covers the design of controls as of a specified date. A Type 2 adds an opinion on whether the controls operated effectively throughout a specified period.

How long does a first SOC 2 report take?

There is no fixed timetable for a first SOC 2 report. We recommend planning for one to three months of readiness work if you already run an ISO 27001 ISMS, and three to six months if you are starting from scratch. A Type 1 can follow soon after. A Type 2 adds an observation period before the auditor can report.

The ranges below are GRCMANA planning guidance, not rules set by the AICPA. Your CPA firm and your customer's expectations will move them.

Put together, we recommend telling a prospect to expect a first Type 1 report in roughly three to six months, and a first Type 2 report in roughly six to twelve months. Both ranges assume readiness work starts straight away.

What are the SOC 2 compliance requirements for your firm?

The SOC 2 compliance requirements are less a checklist than a set of things the route asks of you. You need a defined system in scope, controls that meet the Trust Services Criteria you select, evidence that those controls operate, a written management assertion, and a licensed CPA firm to examine them, every year.

In practice, the route asks your firm for six things:

• A described system. The AICPA's SOC 2 description criteria are used to prepare and evaluate the description of your system, so the scope must be clear enough to write down.
• Designed controls. Each criterion you select needs controls that address it, owned by named people.
• Operating evidence. For a Type 2, records that show the controls worked across the whole period, not just on the day of testing.
• A management assertion. Your leadership states in writing that the description and the controls are fair and suitable.
• A qualified examiner. A licensed CPA firm, chosen on its competence rather than its speed.
• A repeatable rhythm. The same evidence, generated again next year, ideally by your systems rather than by hand.

The last point is where the effort settles. Firms that treat SOC 2 as an annual project rebuild their evidence every year; firms that engineer it into their systems mostly maintain it.

What carries over from an existing ISO 27001 ISMS?

A working ISO 27001 ISMS carries over a great deal: the risk assessment, policies, asset inventory, access control, supplier management, incident response and internal audit habits. What does not carry over is the format. SOC 2 needs a written system description, controls mapped to the Trust Services Criteria, and, for a Type 2, evidence across a defined period.

If you hold an ISO 27001 certificate, you already run a management system that names owners, reviews risk and keeps records. Those are the raw materials a SOC 2 examination tests.

The gaps tend to sit in three places:

• Scope. ISO 27001 scopes a management system; SOC 2 describes a specific system that delivers a service to customers. The two rarely match exactly.
• Evidence over time. An ISO 27001 surveillance audit samples; a SOC 2 Type 2 examination tests operation across the whole period, so gaps in records show.
• Criteria mapping. Your Annex A controls need mapping to the Trust Services Criteria, and some criteria will need controls written for them.

The audit experience transfers too. If your team has been through the ISO 27001 certification process, it already knows how to answer an auditor's request with a record rather than an explanation.

What are the common mistakes with SOC 2 certification?

The common mistakes with SOC 2 certification are calling the report a certificate in sales material, booking a CPA firm before readiness work is done, and choosing a Type 1 report when the customer needs a Type 2. Each costs time with the customer, and the second and third can cost a whole examination cycle.

Calling it a certificate. Sales decks and website copy that say "SOC 2 certified" invite a sharp question from an informed security reviewer. Say you hold a SOC 2 Type 1 or Type 2 report, and name the period.

Starting with the auditor. An examination tests controls that already exist. Engaging a CPA firm before readiness means paying for testing that finds gaps you could have found yourself.

Choosing the wrong type. A Type 1 report is quicker, but many enterprise customers want evidence that controls operated over time. Ask the customer which type they will accept before you commit.

There is a fourth mistake, and the AICPA is now addressing it directly. Its peer review guidance flags SOC 2 engagements with identical reports, risk assessments, sample sizes and testing procedures as not tailored to the client's risks.

A report that looks like every other report tells your customer nothing about you.

The AICPA's journal suggests clients vet a CPA firm's qualifications, experience and peer review results before engaging it, and ask whether an offer is unrealistically fast, easy or cheap.

Frequently asked questions