SOC 2 guide
Do you need SOC 2? A decision guide for SaaS companies, BPOs and service providers selling to enterprises
Who asks for a SOC 2 report and how firmly, what ISO/IEC 27001, SOC 1 or a customer audit can answer instead, whether to start with Type 1, and what to settle before committing, with a decision table for SaaS companies, BPOs and service providers.
Key points
- SOC 2 is not a legal requirement. It becomes a condition when a customer writes it into a contract; until then it is expected or optional.
- Requests come mostly from US enterprises and global groups with US-style vendor-risk programmes, and from partners and investors.
- ISO/IEC 27001, SOC 1 or a customer audit sometimes answers the request better.
- Settle the categories, the systems and an examination period that fits the sales deadline first; wait if the basics or an owner are missing.
The short answer: when your customers' vendor reviews depend on it
You need SOC 2 when customers who matter to your revenue ask for it, or soon will. No statute requires a service organisation to be examined: the AICPA publishes the criteria, licensed CPA firms report against them, and the report becomes an obligation only when a customer makes it a contract term. Start with the questionnaires, draft contracts and lost-deal notes of the past year, and exactly what each asked for.
Who asks for SOC 2, and how firmly
Each request is contractual (a written condition of a signed or pending agreement), expected (asked for routinely; deals close without it, more slowly) or optional (nobody asks yet).
| Who asks | What they usually want | How firm |
|---|---|---|
| US enterprise customers | Your latest SOC 2 report, usually a Type 2, under a non-disclosure agreement | Expected; contractual once in the agreement |
| Global enterprises | A SOC 2 report or an ISO/IEC 27001 certificate, depending on their vendor-risk programme | Expected; ask which they accept |
| Procurement and security teams | A questionnaire with the report attached, then questions on exceptions and on the controls left to them | Expected; they set the pace of onboarding |
| Partners and resellers | Assurance to pass on when their own customers ask about you | Expected where they embed or resell your service |
| Investors and acquirers | The report if you hold one; otherwise the gap analysis findings and a dated plan | Optional; it shortens due diligence |
Phrasing matters: "SOC 2 or equivalent" leaves room that "your SOC 2 Type 2 report" does not, so ask in writing what will satisfy the reviewer.
Alternatives and complements: ISO/IEC 27001, SOC 1 and a customer audit
- ISO/IEC 27001 certification. The certificate, from an accredited certification body, that international customers, notably in Europe, ask for most. It is not the report a US reviewer wants, though one control set can serve both; see SOC 2 vs ISO/IEC 27001: which one, or both?
- A SOC 1 report. It covers controls relevant to customers' internal control over financial reporting, for them and their auditors, and suits payroll, loan servicing or claims processing. It does not answer security questions, and a processor may be asked for both.
- A customer audit. A key account may use its contractual right to audit. One visit is manageable; a dozen are not, while one annual report can be read by every customer.
- Complements. A SOC 3 is a general-use summary of a SOC 2 examination that you may publish. PCI DSS and HIPAA follow their own routes, and a SOC 2 report settles neither.
The operations director notes that the team understood both the compliance requirements and the company's day-to-day processing operations, and that the guidance and remediation plan improved how teams handle sensitive information across shifts and locations while strengthening compliance practice.
Type 1 first, or straight to Type 2?
The deal calendar usually decides which report comes first. A Type 1 covers the design of your controls at a single date; a Type 2 covers their operation across an examination period, which is what enterprise reviewers ultimately expect. No rule requires a Type 1 first.
- Go straight to Type 2 when your controls already run and no deal needs a report before the first period and its fieldwork end.
- Take a Type 1 first when a named deal needs a document sooner and the customer accepts, in writing, a design-only report while the period runs.
- Plan the Type 2 either way. A Type 1 with no period behind it shows design, never operation.
SOC 2 Type 1 vs Type 2: which report, and when covers the detail.
Decision table: from your situation to a recommendation
Pick the nearest row. Where two apply, the one tied to a signed contract or a dated deal wins.
| Your situation | Recommendation | Why |
|---|---|---|
| A signed or pending contract requires a SOC 2 report by a set date | Scope the service it covers and plan backwards, with a Type 1 milestone if needed | A Type 2 cannot exist until its period has run |
| US prospects ask for your report in every security review | Start SOC 2 on the service they use: Security, plus the categories your commitments need | One report, shared under NDA, serves every review |
| Most customers are outside the US and ask for ISO/IEC 27001 | ISO/IEC 27001 certification first; SOC 2 on the same controls when US demand appears | Those customers name the certificate |
| Customers' auditors ask about controls over their financial reporting | SOC 1 for those processes; SOC 2 as well if security questions follow | SOC 2 does not address financial reporting controls |
| One strategic customer wants to audit you | Host that audit; revisit SOC 2 when more enterprise accounts ask | A report pays off when many customers read it |
| A deal needs proof within weeks and no controls have operated | Share a dated plan: gap analysis results, the CPA firm engaged, target report dates | Operation can be reported only after it has happened |
| Nobody is asking, and core controls are missing | Not yet: build the basics and take the free readiness check | Absent controls end up in the report |
Before you commit: six questions to settle
- What exactly did the customer ask for? The report type, categories, service, date, whether an alternative will do, and whether the requirement is already contractual.
- Which trust services categories? Security is always in scope; add the others only where contracts, service levels or your privacy notice already commit you, as SOC 2 scope: system boundaries, trust services categories and carve-outs explains.
- Which systems, teams and locations? The service customers rely on, the people and infrastructure behind it, every delivery centre handling client data, and subservice organisations such as your cloud provider.
- Does the examination period fit the sales deadline? Allow three to six months to a Type 1 report and nine to fifteen months to a first Type 2, whose period usually runs six to twelve months before fieldwork. SOC 2 timeline: from readiness to report, stage by stage breaks the months down.
- Who owns it, every year? A management sponsor, a coordinator with protected time and named control owners. Reports renew annually, so budget for each cycle; SOC 2 cost: what moves the price sets out the drivers.
- Who will be your service auditor? A licensed CPA firm, independent of whoever prepares you; see Choosing a SOC 2 service auditor: what to ask a CPA firm.
When to wait before starting SOC 2
- Nobody is asking and the basics are missing. Build multi-factor authentication, access reviews, logging, tested backups and change approval first, so the examination later tests habits, not intentions.
- The system is about to change. A migration or merger mid-period leaves the description and the evidence straddling two systems; start once it settles.
- Nobody can own it. Without a sponsor and a coordinator with time, evidence fades soon after the policies are approved, and the samples show it.
- Only a shortcut meets the date. A "SOC 2 certificate" in days, or one firm offering both to prepare you and to give the opinion, fails the first reviewer who reads the report; see How to read a SOC 2 report: opinion, exceptions and CUECs.
How Sterling helps you choose
A plain recommendation, drawn from the requests you already hold.
On a discovery call, our expert and experienced consultants read the requests behind the question and tell you whether SOC 2, ISO/IEC 27001, SOC 1 or a later start fits. When SOC 2 is right, we define the system, the categories and the report type, then the gap analysis sets actions, owners and dates against your first deadline, with evidence kept in Effivity, included with the engagement, at no additional cost. We ensure a successful SOC 2 examination for our clients. Sterling does not issue the report: the independent, licensed CPA firm you engage examines the controls and gives the opinion.
Book a free discovery callDeciding on SOC 2: questions buyers ask
Can we sign a contract that requires a SOC 2 report we do not yet have?
Yes, if you can meet the clause. Negotiate the report type and a realistic date rather than "on signature", consider a Type 1 milestone, and agree how exceptions or a qualified opinion would be handled. A clause you cannot meet turns a sales win into a breach.
Is SOC 2 only for SaaS companies?
No. Any service organisation whose controls protect client data can be examined: BPOs, managed service providers, data centres, payroll providers, fintech and professional services firms. The criteria stay the same; see SOC 2 for BPO and shared services.
We are a team of fifteen. Is SOC 2 realistic?
Often, yes. Scope one service, carve out the infrastructure your cloud provider runs (its own report covers it) and keep the controls proportionate. Time, not headcount, is the constraint; see SOC 2 for start-ups and small teams: a right-sized control set.
A customer asked for "SOC 2 compliance". Is a report the only answer?
There is no SOC 2 compliance status; what reviewers recognise is a report from a licensed CPA firm. Ask whether they need it now, whether a questionnaire and a dated plan will serve meanwhile, and which type and categories they expect.
Can we stop after one report?
You can, but customers generally treat a report as current for about twelve months after issue, and ask again on that rhythm. SOC 2 bridge letters, report validity and the annual cycle explains how coverage stays continuous.
More SOC 2 guides
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 bridge letters, report validity and the annual cycle
- SOC 2 common mistakes
- SOC 2 continuous monitoring
- SOC 2 cost: what moves the price
- Effivity for SOC 2: the guide
- SOC 2 exceptions and qualified opinions
- SOC 2 for fintech and payments
- SOC 2 policies and evidence: what you need and what you do not
- The SOC 2 system description: what to write and what to leave out
- SOC 2 Trust Services Criteria explained, criterion by criterion
- SOC 2 Type 1 vs Type 2: which report, and when
- SOC 2 vs ISO/IEC 27001: which one, or both?
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice