SOC 2 by region
SOC 2 in the Netherlands and Europe: who issues the report, ISAE 3000 and how GDPR, NIS2 and DORA meet your readiness project
What is different about SOC 2 for a Dutch or European service organisation: why the request comes from North American clients, who can issue the report, and how GDPR, the Cyberbeveiligingswet and DORA shape the scope.
Key points
- For a Dutch or European service organisation, a SOC 2 request usually arrives from a North American client. European buyers more often ask for ISO/IEC 27001, so a company selling on both sides of the Atlantic may be asked for both.
- No Dutch accreditation body and no public register are involved. A licensed CPA firm issues the SOC 2 report; outside the United States, SOC 2-type reports are performed under ISAE 3000, while ISAE 3402 is the SOC 1-type standard.
- The Cyberbeveiligingswet, in force since 15 August 2026, and the NIS2 supply chain measure push security questions down to suppliers through contracts. A SOC 2 report answers many of them, but it is not compliance with either law.
- GDPR processor duties and, for ICT providers to financial entities, DORA shape which categories and controls belong in scope.
Why organisations in the Netherlands and Europe pursue SOC 2
SOC 2 in the Netherlands is usually driven by the customer, not by Dutch law. A SaaS scale-up in Amsterdam or Twente wins its first enterprise prospect in the United States, and the security questionnaire ends with a request for the latest SOC 2 Type 2 report.
SOC reports are better known in North America, while European procurement teams tend to ask for an ISO/IEC 27001 certificate. The practical question is which comes first and how one control set serves both. That comparison has its own guide: SOC 2 vs ISO/IEC 27001: which one, or both?
Who issues a SOC 2 report for a Dutch organisation
SOC 2 is an attestation, so the accreditation structure behind ISO certificates plays no part and there is no register to search. The report is issued by a licensed CPA firm under the AICPA attestation standards, and it is a restricted-use document shared with clients and prospects under a non-disclosure agreement.
Outside the United States, practitioners also report on controls under the international assurance standards. SOC 2-type engagements are performed under ISAE 3000, the general standard for assurance on non-financial matters. ISAE 3402 is a different engagement: it covers controls relevant to clients' financial reporting and corresponds to SOC 1, not SOC 2. When a client asks for "an ISAE report", confirm the standard, the report type and the criteria before anyone is engaged.
So ask your client in writing which it will accept: a SOC 2 report by a licensed CPA firm, or an ISAE 3000 report on the Trust Services Criteria. Then ask the proposed firm for its licence and peer review status. Sterling does not issue either report. How to vet the firm is covered in Choosing a SOC 2 service auditor: what to ask a CPA firm.
European law that meets the SOC 2 project
GDPR. Most European SOC 2 candidates act as processors for their clients' personal data. The GDPR expects controllers to use only processors with sufficient guarantees, under contracts carrying the Article 28(3) terms, and requires security appropriate to the risk under Article 32. A SOC 2 scope with confidentiality or privacy should reuse the GDPR programme's data inventory, sub-processor list and breach register. See GDPR compliance in the Netherlands and Europe.
The Cyberbeveiligingswet and NIS2. The Dutch law transposing NIS2 entered into force on 15 August 2026, with a duty of care to take appropriate measures, a registration duty and reporting of significant incidents. NIS2 lists supply chain security among the required measures, so in-scope entities pass security requirements on to their suppliers. A SOC 2 report is useful evidence in that conversation; it does not make the supplier compliant. See NIS2 in the Netherlands and Benelux.
DORA. Regulation (EU) 2022/2554 has applied since 17 January 2025 to financial entities and reaches the ICT third-party service providers serving them. The financial entity keeps full responsibility for outsourced ICT and records its contractual arrangements in a register of information. A provider's SOC 2 report supports the entity's assessment but does not replace contract terms or its own oversight. See DORA compliance in the Netherlands and Europe.
Practical logistics. Agree early with the CPA firm the language of the policies and records it will sample, since Dutch-language procedures may need translation. Name every EU cloud region, hosting partner and group entity in the system description, and decide which are carved out.
Local items to settle before the examination period
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| Report the client will accept | SOC 2 by a licensed CPA firm, or ISAE 3000 on the Trust Services Criteria; never assume ISAE 3402 will do | Your client's vendor risk or procurement team, in writing |
| The issuing firm | Licence, peer review status, independence from your consultants, proposed period and categories | The firm itself, and the licensing records it points you to |
| GDPR processor role | Processor agreements, sub-processor list and breach handling feed the confidentiality and privacy criteria | The GDPR text on EUR-Lex and your data protection adviser |
| Cyberbeveiligingswet | Whether you are an in-scope entity or a supplier to one, and which contract clauses follow | The Dutch government's Digital Government pages on the Cbw |
| DORA contracts | Financial-sector clients will map your services to their register of information and contract requirements | The regulation on EUR-Lex and EIOPA's DORA pages |
How Sterling works in the Netherlands and Europe
Sterling supports European clients from its office in Enschede, as part of a team working in 60+ countries. Our consultants scope the system, run the gap analysis, design controls that also serve GDPR, NIS2 and DORA obligations and test readiness before the period starts, with the evidence held in Effivity. You choose Design™ or Drive™ according to how much of the work your team carries. The licensed CPA firm you appoint examines and issues the report.
How Sterling supports SOC 2 in Europe
One control set for your US clients and your European obligations
We map what you already run for GDPR, ISO/IEC 27001 or NIS2 to the Trust Services Criteria, close the gaps and keep evidence flowing through the period.
Book a free discovery callFAQs
Can a Dutch audit firm issue our SOC 2 report?
A SOC 2 report is issued by a licensed CPA firm under the AICPA attestation standards, so a Dutch firm can only issue one if it holds that standing. Some European practitioners instead report under ISAE 3000 on the same criteria; ask your client which it accepts before engaging anyone.
Is an ISAE 3402 report the same as SOC 2?
No. ISAE 3402 covers controls relevant to your clients' financial reporting and corresponds to SOC 1. SOC 2-type reports on security and the other categories are performed under ISAE 3000.
Does a SOC 2 report make us compliant with NIS2 or the Cyberbeveiligingswet?
No. The law places its duties on in-scope entities and is supervised nationally; a SOC 2 report is evidence you can offer customers who pass NIS2 supply chain requirements to you, not proof of compliance.
Does SOC 2 help with DORA for our financial-sector clients in Europe?
It helps, but not on its own. A financial entity keeps full responsibility for outsourced ICT and needs contract terms and register entries a SOC 2 report does not provide.
SOC 2 by region
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 readiness in Australia
- SOC 2 implementation plan
- SOC 2 readiness in India
- SOC 2 for managed service providers and data centres
- SOC 2 readiness in the Netherlands and Europe
- SOC 2 policies and evidence
- SOC 2 readiness review checklist
- How to read a SOC 2 report
- SOC 2 readiness in Singapore and South East Asia
- SOC 2 readiness in the Philippines
- SOC 2 readiness in the United Kingdom
- SOC 2 readiness in the UAE and GCC
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 readiness in the Netherlands and Europe with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice