SOC 2 by region
SOC 2 in the UK: who issues the report, ISAE 3000, Cyber Essentials and UK GDPR
What is different about SOC 2 for UK service organisations: who can issue the report, when ISAE 3000 applies, and how Cyber Essentials, UK GDPR and the NIS Regulations sit beside it.
Key points
- A SOC 2 report under the AICPA standards is issued by a licensed CPA firm; outside the United States a practitioner can report under ISAE 3000. Confirm which your clients accept before appointing a firm.
- A SOC 2 report does not replace Cyber Essentials, which PPN 014 expects of suppliers to central government and NHS bodies.
- A SOC 2 report does not show UK GDPR compliance, though the privacy category can support your security evidence.
- Sterling supports SOC 2 readiness from its London office. Sterling does not issue the report; an independent, licensed CPA firm examines your controls and gives the opinion.
Why UK organisations pursue SOC 2
For most UK service organisations the request comes from across the Atlantic. A London SaaS company closing its first US enterprise deal, or a managed service provider bidding for a US-headquartered client, receives a security questionnaire asking for a current SOC 2 report. For UK scale-ups, getting SOC 2 in London is usually a sales decision before it is a security one.
Domestic buyers ask differently. UK public-sector contracts point to Cyber Essentials, and many UK enterprise buyers ask about ISO/IEC 27001. A company selling on both sides of the Atlantic often needs more than one. The comparison itself is covered in SOC 2 vs ISO/IEC 27001: which one, or both?
Who can issue a SOC 2 report for a UK company
SOC 2 is the AICPA's reporting framework on a service organisation's controls against the Trust Services Criteria; the criteria are explained in SOC 2 Trust Services Criteria explained, criterion by criterion. What matters in the UK is who signs the report.
A SOC 2 report under the AICPA attestation standards is issued by a licensed CPA firm. The AICPA warns buyers about providers that are unlicensed or not enrolled in peer review. Outside the United States, practitioners also report on SOC 2-type engagements under ISAE 3000, the IAASB's general standard for assurance on non-financial subject matter. The companion standard ISAE 3402 covers controls relevant to clients' financial reporting, which is SOC 1 territory, not SOC 2.
So find out what your clients accept first: one US client may specify an AICPA report, another may accept ISAE 3000. Ask each prospective firm which standard it will report under, for its licence and peer review status, and for the categories and period it proposes, then confirm those details with the firm directly. The questions to ask are set out in Choosing a SOC 2 service auditor: what to ask a CPA firm.
UK laws and schemes that sit beside SOC 2
UK GDPR and the Data Protection Act 2018. The ICO describes the UK GDPR as the GDPR retained in domestic law, sitting alongside an amended Data Protection Act 2018. The Data (Use and Access) Act 2025 amends both, in stages. The ICO's security guidance restates the duty to apply appropriate technical and organisational measures. SOC 2 controls help show you meet that duty, but the opinion is not a statement of legal compliance. If you process personal data for clients, consider the privacy category, and keep records of processing and breach procedures under your UK GDPR programme.
Cyber Essentials and PPN 014. PPN 014 applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. It makes evidence of a Cyber Essentials certificate, or an equivalent, essential when data is to be passed to a supplier,, renewed every year of the contract. The note says ISO 27001 does not automatically meet Cyber Essentials, and a SOC 2 report cannot be assumed to either.
The NIS Regulations 2018. These apply to operators of essential services and relevant digital service providers, and are enforced by several competent authorities. If you, or an operator you supply, are in scope, your control set should also produce that evidence. The Cyber Security and Resilience Bill was still before Parliament when this page was written and is not yet law.
Logistics. A UK entity often has teams or hosting elsewhere. Name every location and subservice organisation in the system boundary, and book fieldwork early: walkthroughs across time zones take time to schedule.
What to check for a SOC 2 project in the UK
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| Who issues the report | A licensed CPA firm under the AICPA standards, or a practitioner under ISAE 3000; Sterling does not issue it | The firm's licence and peer review details, confirmed with the firm, and the AICPA's guidance on SOC reports |
| What your clients accept | A US client may name the report standard, type and categories it needs | The security questionnaire, master services agreement or vendor onboarding requirements |
| UK GDPR and the Data Protection Act 2018 | Duties that sit alongside SOC 2; a reason to consider the privacy category | The Information Commissioner's Office website |
| Cyber Essentials under PPN 014 | A separate certificate for central government and NHS contracts, renewed every year | The PPN 014 page on GOV.UK and the NCSC certificate search |
| NIS Regulations 2018 | Extra evidence expectations if you, or a client you supply, are in scope | The NIS collection on GOV.UK and your competent authority |
How Sterling works in the United Kingdom
Sterling supports SOC 2 in London and across the UK from its London office, on site and remotely, as part of an international practice of 8,100+ client engagements in 60+ countries since 2003. We help UK teams run one control set that serves SOC 2, ISO/IEC 27001, Cyber Essentials and UK GDPR.
How Sterling supports UK service organisations
Controls your US clients will accept and your UK obligations still need
We confirm the report your clients expect, run the gap analysis, design the controls and system description with your team, build the evidence in Effivity through the examination period, and stay with you through the CPA firm's fieldwork. We ensure a successful SOC 2 examination for our clients.
Book a free discovery callSOC 2 in the UK: questions buyers ask
Why does a UK company need SOC 2?
Usually because a US client or a US-headquartered enterprise asks for it in a security questionnaire. UK public-sector buyers ask for Cyber Essentials instead.
Can a UK accountancy firm issue our SOC 2 report?
A report under the AICPA standards must be issued by a licensed CPA firm; a UK practitioner may instead report on the same criteria under ISAE 3000. Ask the firm which standard it will use, and confirm your clients accept it before you sign.
Does SOC 2 count as Cyber Essentials for UK government contracts?
Not automatically. PPN 014 asks for a Cyber Essentials certificate or an equivalent, and ISO 27001 alone does not qualify automatically, so plan for Cyber Essentials if you supply central government or the NHS.
Does a SOC 2 report make us UK GDPR compliant?
No. SOC 2 gives an opinion on your controls, not on your legal compliance. The privacy and confidentiality categories can support your UK GDPR security evidence, but the duties under the UK GDPR and the Data Protection Act 2018 remain.
SOC 2 by region
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 readiness in Australia
- SOC 2 readiness in India
- SOC 2 readiness in the Netherlands and Europe
- SOC 2 readiness in Singapore and South East Asia
- The SOC 2 system description
- The SOC 2 examination
- SOC 2 readiness in the Philippines
- SOC 2 readiness in the United Kingdom
- SOC 2 timeline
- SOC 2 training
- SOC 2 Trust Services Criteria explained
- SOC 2 readiness in the UAE and GCC
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan your SOC 2 readiness in the United Kingdom with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice