SOC 2 that stands up to the audit, and the security review.

SOC 2 is an attestation report, issued by a licensed CPA firm, on how a service organisation’s controls meet the AICPA Trust Services Criteria: Security, plus optionally Availability, Processing Integrity, Confidentiality and Privacy. It is the security report US customers most often ask software and service providers for.

A Type 1 report assesses whether your controls are suitably designed at a point in time. A Type 2 report tests whether they operated effectively over a period, typically three to twelve months. Many companies start with Type 1 to unblock deals, then move to Type 2.

Security is always in scope. Add the others only where they match what you promise customers or what they ask for: Availability if you commit to uptime, Confidentiality if you hold customer data under NDA or contract, Processing Integrity if customers rely on the accuracy of what your system calculates or processes, and Privacy if you collect personal information directly from individuals. Many first reports cover Security alone, or Security plus Availability and Confidentiality.

Security is the common criteria (CC1 to CC9): control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation. Every SOC 2 report covers it, and the other criteria build on those same controls.

When you have uptime commitments or SLAs, or customers depend on your platform to run their business. It adds controls for capacity planning, monitoring, backups, disaster recovery and tested recovery procedures.

Confidentiality covers information your customers or partners designate as confidential, such as business data, intellectual property or contracts, and how you protect and dispose of it. Privacy covers personal information about individuals and how you collect, use, retain, disclose and dispose of it. Business-to-business SaaS usually chooses Confidentiality; Privacy suits companies collecting personal information directly from consumers.

No. The SOC 2 Privacy criteria overlap with privacy law but are not a legal compliance assessment. If you need to show privacy compliance, look at our GDPR readiness or a certifiable privacy system under ISO 27701.

Whether your system processes data completely, accurately, on time and as authorised. It is most relevant for payments, billing, payroll, financial calculations and data pipelines. For most SaaS products it is not needed.

Yes. Many companies start with Security, then add Availability or Confidentiality in a later report as customers ask. Each added criterion brings more controls and auditor testing, so we help you include only what customers actually need.

If your customers are mostly in the US, SOC 2 is usually what they ask for. In Australia, Europe and Asia, ISO 27001 is more widely recognised. Because the controls overlap heavily, we can design one program that maps to both.

Only a licensed CPA firm can issue a SOC 2 report. You engage the CPA firm directly; we recommend and introduce firms we have worked with, get you ready and support you through their audit. The CPA firm issues the report.

Readiness depends on how much is already in place. After that, a Type 1 report reflects a single date, while a Type 2 report needs an observation period, typically three to twelve months, before the CPA firm can report. We plan the timeline around the deal that needs the report.

Yes, especially by Australian companies selling to US customers and by enterprises with US parents. Local buyers more often ask for ISO 27001. Because the controls overlap heavily, we can build one program that supports both.

The criteria in scope, your systems and whether you need Type 1 or Type 2 set the starting point. We then work with you on the total cost, including the CPA firm’s audit fee, any platform and your team’s time, and shape the engagement so your budget goes further. You get a written proposal after a free consultation.