SOC 2 by region
SOC 2 in Australia: who issues the report, APRA CPS 234, the Essential Eight and IRAP
What is different about SOC 2 for Australian service organisations: who can issue the report, and how APRA CPS 234, the Essential Eight, IRAP and the Privacy Act sit beside it.
Key points
- Australian SaaS and service firms usually meet SOC 2 through a US customer, but APRA-regulated banks, insurers and super funds also assess the security of the vendors that hold their information assets under CPS 234.
- A SOC 2 report is not an IRAP assessment and does not show an Essential Eight maturity level, so government work may need separate evidence.
- The report is signed by a licensed CPA firm under the AICPA standards, or by a practitioner under ISAE 3000; confirm which your buyers accept before you engage one.
- Sterling supports SOC 2 readiness from its Sydney office. Sterling does not issue the report; an independent, licensed CPA firm examines your controls and gives the opinion.
Why Australian organisations pursue SOC 2
The first request often arrives with a US deal. A Sydney software company courting a US enterprise receives a vendor security review that expects a current SOC 2 report. For many Australian scale-ups, SOC 2 in Australia starts as a condition of export revenue.
The second source of demand is at home. Australian financial institutions regulated by APRA work under Prudential Standard CPS 234 Information Security, which requires them to assess the information security capability of third parties in line with the consequences of an incident, and to evaluate the design of controls where a third party manages their information assets. A Type 2 report is one structured way for a vendor to answer, alongside the institution's own questionnaire; the weight it carries is the institution's call.
Australian enterprise buyers may ask for ISO/IEC 27001 as well; see SOC 2 vs ISO/IEC 27001: which one, or both?
Who can issue a SOC 2 report for an Australian company
SOC 2 reports on controls against the AICPA's Trust Services Criteria, explained in SOC 2 Trust Services Criteria explained, criterion by criterion.
A report under the AICPA attestation standards is issued by a licensed CPA firm, and the AICPA cautions buyers about providers that are unlicensed or not enrolled in peer review. Outside the United States, practitioners also report on the same criteria under ISAE 3000, the international standard for assurance on non-financial subject matter; ISAE 3402 is the SOC 1 counterpart. No accreditation body is involved and there is no register to check: SOC 2 is an attestation, not a certification.
First ask your customers which report they will accept. Then ask the firm which standard it will report under, its licence and peer review status, the categories in scope and the period proposed, and confirm those answers with the firm directly. Choosing a SOC 2 service auditor: what to ask a CPA firm sets out the questions.
Australian regulation and frameworks that sit beside SOC 2
APRA CPS 234. The standard applies to authorised deposit-taking institutions, general insurers, life companies, private health insurers and RSE licensees. It expects incident notification to APRA within 72 hours for material incidents, testing by skilled and functionally independent specialists, and internal audit coverage of controls maintained by third parties. If you serve these entities, let the same incident, testing and subservice records answer their assessments and your CPA firm's sampling.
The Essential Eight. ASD's Essential Eight Maturity Model sets eight mitigation strategies. For non-corporate Commonwealth entities under the Protective Security Policy Framework, Maturity Level Two is the mandatory baseline. A SOC 2 opinion does not state a maturity level. If you sell to government, map your SOC 2 controls to the eight strategies.
IRAP. ASD endorses IRAP assessors to assess ICT systems and cloud services. A government buyer may ask for an IRAP assessment; a SOC 2 report cannot be assumed to replace it.
The Privacy Act 1988 and notifiable data breaches. The OAIC's Notifiable Data Breaches scheme requires organisations covered by the Privacy Act to notify affected individuals and the OAIC where a breach is likely to result in serious harm. If you hold personal information for clients, consider the privacy category and build that assessment into your incident procedure.
Critical infrastructure. The frameworks listed in the SOCI critical infrastructure risk management rules include AS ISO/IEC 27001, the Essential Eight and the NIST Cybersecurity Framework. SOC 2 is not among them.
What to check for a SOC 2 project in Australia
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| Who issues the report | A licensed CPA firm under the AICPA standards, or a practitioner under ISAE 3000; Sterling does not issue it | The firm's licence and peer review details, confirmed with the firm, and the AICPA's guidance on SOC reports |
| APRA CPS 234 | Financial-services clients assess your controls and may test them; incident and testing records need to satisfy both | The CPS 234 page on APRA's website |
| Essential Eight | A maturity level that SOC 2 does not state; map your controls if you sell to government | ASD's Essential Eight Maturity Model FAQ on cyber.gov.au |
| IRAP | A separate assessment by an ASD-endorsed assessor, sometimes asked for cloud services | The IRAP pages on cyber.gov.au |
| Notifiable Data Breaches scheme | Your incident procedure must support the serious-harm assessment and notification | The Office of the Australian Information Commissioner's website |
If you use cloud regions or teams in other countries, name every location and subservice organisation in the system boundary, and book fieldwork early if your CPA firm works from US time zones.
How Sterling works in Australia
Sterling supports SOC 2 in Sydney and across Australia from its Sydney office, on site and remotely, as part of an international practice of 8,100+ client engagements in 60+ countries since 2003.
How Sterling supports Australian service organisations
One set of controls for US customers, APRA-regulated clients and government buyers
We confirm the report your customers expect, run the gap analysis, design the controls and system description with your team, build the evidence in Effivity through the examination period, and stay with you through the CPA firm's fieldwork. We ensure a successful SOC 2 examination for our clients.
Book a free discovery callSOC 2 in Australia: questions buyers ask
Does a SOC 2 report satisfy APRA CPS 234?
Not on its own. CPS 234 places the obligation on the APRA-regulated entity, which must assess your security capability and the design of your controls; a SOC 2 Type 2 report is useful evidence for that assessment, but the entity decides what it needs.
Is SOC 2 the same as IRAP or the Essential Eight?
No. IRAP is an assessment by an ASD-endorsed assessor, and the Essential Eight is a maturity model; a SOC 2 report gives a CPA firm's opinion on your controls and states neither.
Can an Australian audit firm issue our SOC 2 report?
A report under the AICPA standards must be issued by a licensed CPA firm; a practitioner may instead report on the same criteria under ISAE 3000. Check your customers accept it before you sign.
Does SOC 2 help with the Notifiable Data Breaches scheme?
It helps with the controls, not the legal duty. Your incident response and privacy controls can be examined in SOC 2, but notifying individuals and the OAIC of an eligible breach remains your obligation under the Privacy Act 1988.
SOC 2 by region
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 for accounting firms and professional services
- SOC 2 bridge letters, report validity and the annual cycle explained
- SOC 2 auditor questions
- SOC 2 readiness in Australia
- SOC 2 benefits
- SOC 2 for BPO and shared services
- SOC 2 case study
- SOC 2 readiness in India
- SOC 2 readiness in the Netherlands and Europe
- SOC 2 readiness in Singapore and South East Asia
- SOC 2 readiness in the Philippines
- SOC 2 readiness in the United Kingdom
- SOC 2 readiness in the UAE and GCC
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 readiness in Australia with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice