---
title: "SOC 2 certification: what you actually get and the route to your first report"
canonical: https://www.grcmana.io/vault/soc-2/certification
published: 2026-10-21
updated: 2026-10-23
author: "Harry West"
framework: "SOC 2"
control: "Guide SOC 2 certification: what you actually get and the route to your first report"
journeyStage: fundamentals
---

# SOC 2 certification: what you actually get and the route to your first report

## Key takeaways

SOC 2 certification is the everyday name for a SOC 2 report, an attestation issued by a licensed CPA firm under AICPA standards. The report is restricted to specified parties and shared under NDA, while a SOC 3 report can be distributed freely. The route runs readiness, a Type 1 or Type 2 choice, the examination, the report, then repeats each year.

- **Who issues it** — A licensed CPA firm, performing an examination under the AICPA's Statements on Standards for Attestation Engagements. Software platforms that are not CPA firms cannot attest that controls are effective.
- **Restricted use** — SOC 2 reports are restricted to specified parties who understand the service organisation's system, so they are shared under NDA. SOC 3 reports are general use and freely distributable.
- **Type 1 and Type 2** — A Type 1 report covers the design of controls as of a specified date. A Type 2 adds an opinion on whether controls operated effectively throughout a specified period.
- **ISO 27001 contrast** — An ISO 27001 certificate comes from an accredited certification body and can be verified on UKAS CertCheck. A SOC 2 report has no certificate and no register entry.

A US prospect's security team has sent the vendor form, and one line reads "please attach your SOC 2 certification". The deal is waiting on it, and you are not sure what to commit to. This guide is for founders, COOs and security leads at UK B2B tech firms with 25 to 100 staff, many of whom already hold or are pursuing ISO 27001.

The short answer is that there is no SOC 2 certificate. What you receive is an attestation report from an independent, licensed CPA firm. This guide explains what that means, what you hand the customer, and the route to your first report in the order you take it.

## Is there such a thing as SOC 2 certification?

No. SOC 2 certification is the common name for a SOC 2 report: an attestation issued by an independent, licensed CPA firm under AICPA attestation standards. The report gives an opinion on your controls against the Trust Services Criteria. The route runs readiness, a Type 1 or Type 2 choice, the examination, the report, then the same again each year.

The [Journal of Accountancy, the AICPA's own journal,](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) describes SOC reports as examinations performed by CPAs under the AICPA's Statements on Standards for Attestation Engagements. The same article notes that "compliance" is a term never used in SOC 2 examinations.

What you receive is a SOC 2 attestation: a document, signed by the CPA firm, that a customer reads. There is no certificate, no certificate number and no register entry. The [hub page on SOC 2](https://www.grcmana.io/vault/soc-2) covers what the framework is and the five criteria categories it can address.

A SOC 2 report is an opinion, not a badge.

The criteria themselves come from the AICPA. Its [2017 Trust Services Criteria](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) are control criteria set by the AICPA's Assurance Services Executive Committee for use in attestation engagements. Your controls are measured against them, and your system is described using the AICPA's separate description criteria.

## How is a SOC 2 report different from an ISO 27001 certificate?

A SOC 2 report is an attestation by a CPA firm that describes your system, your controls and, for a Type 2, how they operated over a period. An ISO 27001 certificate is issued by an accredited certification body after auditing your management system. One is a detailed report shared privately; the other is a certificate anyone can verify.

[UKAS describes certification](https://www.ukas.com/accreditation/about/accreditation-vs-certification/) as third-party confirmation, via audit, of an organisation's systems. UKAS accredits the certification bodies that do that auditing, and its free CertCheck database lets anyone verify a UKAS-accredited management system certificate.

SOC 2 sits outside that structure entirely. No UKAS-accredited certification body issues it, and nothing about it appears on CertCheck.

|  | SOC 2 report | ISO 27001 certificate |
| --- | --- | --- |
| What you receive | An attestation report with the CPA firm's opinion | A certificate stating your management system conforms to the standard |
| Who issues it | A licensed CPA firm under AICPA attestation standards | A certification body, accredited in the UK by UKAS |
| What is assessed | Controls over your described system, against the Trust Services Criteria | Your information security management system, against ISO/IEC 27001 |
| How it is shared | Restricted to specified parties, usually under NDA | Public; the certificate can be published and verified |
| Public version | A SOC 3 report, with less detail | The certificate itself |
| How long it lasts | Covers a date (Type 1) or a period (Type 2); customers ask for a current one | Runs on a certification cycle, with surveillance and recertification audits |

The detail is the point. A SOC 2 report shows a customer how you run your controls; an ISO 27001 certificate tells them an accredited body has checked that you run them.

## What should you tell a customer who asks for your SOC 2 certificate?

Tell them you can provide a SOC 2 report rather than a certificate, and name its type and the period or date it covers. Send it under a non-disclosure agreement, because SOC 2 reports are restricted-use. If they need something they can share freely, a SOC 3 report or your ISO 27001 certificate does that job.

The restriction is not a formality. According to the AICPA's journal, SOC 2 reports are restricted to specified parties who understand the service organisation's system and the services it provides.

A short, accurate reply usually lands better than a scramble. Something like this works:

- **If you have a report:** "We hold a SOC 2 Type 2 report covering [period]. We can share it under NDA."
- **If you are on the route:** "We are preparing for our first SOC 2 examination, with a report expected by [month]. Meanwhile, here is our ISO 27001 certificate and its scope."
- **If they need something public:** "Our SOC 3 report and ISO 27001 certificate can be shared without an NDA."

The [AICPA's SOC 3 page](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3) explains that SOC 3 reports address the same subject matter as SOC 2 but without the same level of detail, so they are general use reports and can be freely distributed. That makes SOC 3 the version for a website or a trust centre.

## How do you get SOC 2 certification?

You get SOC 2 certification, meaning a SOC 2 report, in five steps: assess your readiness and close the gaps, choose a Type 1 or Type 2 report, engage a licensed CPA firm for the examination, receive and share the report, then repeat each year. Readiness comes first because the examination tests what already exists.

Each step has its own decisions. Here is the SOC 2 certification process as one map:

1. **Readiness.** Define the system and services in scope, map your controls to the Trust Services Criteria, and close the gaps before anyone is paid to test them. A [SOC 2 readiness assessment](https://www.grcmana.io/vault/soc-2/readiness-assessment) sets out the method.
2. **Type 1 or Type 2.** Choose the report type your customer will accept. The [comparison of Type 1 and Type 2](https://www.grcmana.io/vault/soc-2/type-1-vs-type-2) covers the trade-offs and the observation period.
3. **The examination.** A licensed CPA firm tests your controls against the criteria. Management also provides a written assertion about the system description and the controls.
4. **The report.** You receive the CPA firm's report, including its opinion and, for a Type 2, the tests it ran and their results. You share it with customers under NDA.
5. **The annual cycle.** Customers expect a current report, so the examination repeats. A bridge letter from management can cover the gap between one report period and the next.

The difference between the two report types matters most at step 2. A [Journal of Accountancy explainer](https://www.journalofaccountancy.com/newsletters/2016/jun/3-face-of-soc/) sets it out: a Type 1 report covers the design of controls as of a specified date. A Type 2 adds an opinion on whether the controls operated effectively throughout a specified period.

## How long does a first SOC 2 report take?

There is no fixed timetable for a first SOC 2 report. We recommend planning for one to three months of readiness work if you already run an ISO 27001 ISMS, and three to six months if you are starting from scratch. A Type 1 can follow soon after. A Type 2 adds an observation period before the auditor can report.

The ranges below are GRCMANA planning guidance, not rules set by the AICPA. Your CPA firm and your customer's expectations will move them.

| Stage | We recommend planning for | What moves it |
| --- | --- | --- |
| Readiness and remediation, with an ISO 27001 ISMS | 1 to 3 months | How many controls already produce evidence |
| Readiness and remediation, from scratch | 3 to 6 months | Whether core practices such as access reviews and change control exist yet |
| Type 1 examination and report | 4 to 8 weeks after controls are in place | The CPA firm's availability and how quickly you answer requests |
| Type 2 observation period | At least 3 months for a first report | What your customer will accept |
| Type 2 testing and report | 4 to 8 weeks after the period ends | The quality of your evidence |

Put together, we recommend telling a prospect to expect a first Type 1 report in roughly three to six months, and a first Type 2 report in roughly six to twelve months. Both ranges assume readiness work starts straight away.

## What are the SOC 2 compliance requirements for your firm?

The SOC 2 compliance requirements are less a checklist than a set of things the route asks of you. You need a defined system in scope, controls that meet the Trust Services Criteria you select, evidence that those controls operate, a written management assertion, and a licensed CPA firm to examine them, every year.

In practice, the route asks your firm for six things:

- **A described system.** The AICPA's [SOC 2 description criteria](https://www.aicpa-cima.com/resources/download/get-description-criteria-for-your-organizations-soc-2-r-report) are used to prepare and evaluate the description of your system, so the scope must be clear enough to write down.
- **Designed controls.** Each criterion you select needs controls that address it, owned by named people.
- **Operating evidence.** For a Type 2, records that show the controls worked across the whole period, not just on the day of testing.
- **A management assertion.** Your leadership states in writing that the description and the controls are fair and suitable.
- **A qualified examiner.** A licensed CPA firm, chosen on its competence rather than its speed.
- **A repeatable rhythm.** The same evidence, generated again next year, ideally by your systems rather than by hand.

The last point is where the effort settles. Firms that treat SOC 2 as an annual project rebuild their evidence every year; firms that engineer it into their systems mostly maintain it.

## What carries over from an existing ISO 27001 ISMS?

A working ISO 27001 ISMS carries over a great deal: the risk assessment, policies, asset inventory, access control, supplier management, incident response and internal audit habits. What does not carry over is the format. SOC 2 needs a written system description, controls mapped to the Trust Services Criteria, and, for a Type 2, evidence across a defined period.

If you hold an [ISO 27001 certificate](https://www.grcmana.io/vault/iso-27001), you already run a management system that names owners, reviews risk and keeps records. Those are the raw materials a SOC 2 examination tests.

The gaps tend to sit in three places:

- **Scope.** ISO 27001 scopes a management system; SOC 2 describes a specific system that delivers a service to customers. The two rarely match exactly.
- **Evidence over time.** An ISO 27001 surveillance audit samples; a SOC 2 Type 2 examination tests operation across the whole period, so gaps in records show.
- **Criteria mapping.** Your Annex A controls need mapping to the Trust Services Criteria, and some criteria will need controls written for them.

The audit experience transfers too. If your team has been through the [ISO 27001 certification process](https://www.grcmana.io/vault/iso-27001/certification-process), it already knows how to answer an auditor's request with a record rather than an explanation.

## What are the common mistakes with SOC 2 certification?

The common mistakes with SOC 2 certification are calling the report a certificate in sales material, booking a CPA firm before readiness work is done, and choosing a Type 1 report when the customer needs a Type 2. Each costs time with the customer, and the second and third can cost a whole examination cycle.

**Calling it a certificate.** Sales decks and website copy that say "SOC 2 certified" invite a sharp question from an informed security reviewer. Say you hold a SOC 2 Type 1 or Type 2 report, and name the period.

**Starting with the auditor.** An examination tests controls that already exist. Engaging a CPA firm before readiness means paying for testing that finds gaps you could have found yourself.

**Choosing the wrong type.** A Type 1 report is quicker, but many enterprise customers want evidence that controls operated over time. Ask the customer which type they will accept before you commit.

There is a fourth mistake, and the AICPA is now addressing it directly. Its [peer review guidance](https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/) flags SOC 2 engagements with identical reports, risk assessments, sample sizes and testing procedures as not tailored to the client's risks.

A report that looks like every other report tells your customer nothing about you.

The AICPA's journal suggests clients vet a CPA firm's qualifications, experience and peer review results before engaging it, and ask whether an offer is unrealistically fast, easy or cheap.

## Frequently asked questions

### Can an individual get SOC 2 certified?

No. A SOC 2 report covers an organisation's system and controls, so there is no SOC 2 certification for a person. Training courses that use the phrase teach people about SOC 2; they do not make anyone a SOC 2 examiner, which requires a licensed CPA firm.

### Does a SOC 2 report expire?

A SOC 2 report does not carry an expiry date, but it only describes a date or a past period. Customers judge how current it is, and many expect a new report each year. Between reports, a bridge letter from management can confirm that nothing material has changed.

### Who is allowed to issue a SOC 2 report?

Only a licensed CPA firm can perform the examination and sign the opinion. The AICPA has said it assists regulators, including referrals to US state boards of accountancy, regarding unlicensed firms and practitioners. Software platforms can help collect evidence, but they cannot issue the report.

### Is there a UK alternative to a SOC 2 report?

Yes. A UK or international assurance firm can report on controls under ISAE 3000 (Revised), which [ICAEW describes](https://www.icaew.com/technical/audit-and-assurance/assurance/standards-and-guidance) as a principles-based standard that can be applied to a broad range of subject matters. Some US customers will still ask for SOC 2 by name, so check before choosing.

### Can we publish our SOC 2 report on our trust centre?

Not the full report, because SOC 2 reports are restricted-use. What you can publish is the fact of it: the report type, the period or date it covers, and how to request a copy under NDA. A SOC 3 report is the version you can post in full.