The request usually arrives in a procurement questionnaire: "Please provide your most recent SOC 2 Type 2 report." If you do not have one, the deal slows down or stops. For SaaS and IT services companies selling to US and enterprise customers, SOC 2 has become a practical requirement.
The good news is that SOC 2 is not mysterious. It rewards organisations that do sensible security work consistently and can prove it. This SOC 2 compliance checklist walks through what to decide, what to build and what evidence to collect before the auditor arrives.
Note: this guide is general information, not audit or legal advice. Your CPA firm determines how criteria apply to your organisation.
What is SOC 2?
SOC 2 is an attestation report on a service organisation's controls, issued by an independent CPA firm. Controls are evaluated against the Trust Services Criteria defined by the American Institute of Certified Public Accountants (AICPA). It is not a certification you pass once; it is an auditor's opinion on whether your controls are designed and, for Type 2, operating effectively.
Step 1: Choose your Trust Services Criteria
There are five criteria. Security (also called the Common Criteria) is required in every SOC 2 report; the other four are optional and are included based on the services you provide and the data you handle.
- Security: protecting systems and data against unauthorised access and disclosure (mandatory)
- Availability: systems are available for operation and use as committed
- Processing integrity: processing is complete, valid, accurate, timely and authorised
- Confidentiality: information designated as confidential is protected
- Privacy: personal information is collected, used, retained and disposed of appropriately
Checklist: start with Security. Add Availability if customers depend on your uptime, Confidentiality if you hold sensitive customer data, and Privacy if you process personal information directly. Do not add criteria just to look thorough; each one adds controls and audit effort.
Step 2: Decide between Type 1 and Type 2
- Type 1 assesses whether controls are suitably designed at a single point in time.
- Type 2 assesses whether controls operated effectively over an observation period, commonly between three and twelve months.
Many companies start with Type 1 to unblock sales conversations, then move to Type 2. Ask your key customers which they will accept.
Step 3: Define scope
List the systems, people, processes and data in scope: production infrastructure, the application, supporting tools (code repository, CI/CD, ticketing), and the teams that operate them. Tight scope makes the audit manageable. Write a system description early, because the auditor will need it.
Step 4: Build the core controls
These areas appear in almost every SOC 2 audit.
Governance and policies
- Information security policy approved by leadership
- Defined roles and responsibilities for security
- Annual risk assessment
- Security awareness training for all staff, with records
Access control
- Single sign-on and multi-factor authentication for all critical systems
- Role-based access following least privilege
- Documented joiner, mover and leaver process, with prompt access removal
- Periodic access reviews (commonly quarterly), with evidence of sign-off
- Restricted, monitored privileged access
Change management
- Code changes reviewed and approved before deployment
- Separation between development and production
- Tracked tickets linking changes to approvals
System operations and monitoring
- Centralised logging and alerting for security events
- Vulnerability scanning and patching with defined timelines
- Incident response plan, tested at least annually
- Endpoint protection and device management on company laptops
Data protection
- Encryption in transit and at rest
- Backups with tested restores
- Data classification and retention rules
Vendor management
- Inventory of vendors with access to systems or data
- Due diligence on critical vendors (their own SOC 2 reports, for example)
Business continuity (if Availability is in scope)
- Documented continuity and disaster recovery plans, tested
Step 5: Collect evidence continuously
Auditors test samples. For Type 2 they want proof that controls operated throughout the period, not just on audit day. Typical evidence includes access review records, onboarding and offboarding tickets, change approvals, training completion, vulnerability scan reports and incident tickets.
Automate collection where you can. A control nobody can prove is, for audit purposes, a control that does not exist.
Step 6: Run a readiness assessment
Before engaging the auditor for the real thing, run a gap assessment against the criteria you selected. Fix gaps, then start the Type 2 observation period once controls are stable.
A realistic timeline
- Months 1–3: readiness assessment, policies, core controls
- Month 3–4: Type 1 audit (optional)
- Months 4–10: Type 2 observation period, continuous evidence
- Months 10–12: Type 2 fieldwork and report
Timelines vary widely with company size and starting maturity.
SOC 2 vs ISO 27001
Buyers often ask whether to pursue SOC 2, ISO 27001 or both. They overlap significantly but differ in form.
- Origin — SOC 2: AICPA (United States). ISO 27001: International standard (ISO/IEC).
- Output — SOC 2: Attestation report by a CPA firm. ISO 27001: Certificate from an accredited certification body.
- Focus — SOC 2: Controls relevant to the Trust Services Criteria. ISO 27001: An information security management system (ISMS).
- Typical demand — SOC 2: US customers and SaaS buyers. ISO 27001: Europe, Asia, global enterprises and public sector.
- Detail shared — SOC 2: Detailed report shared under NDA. ISO 27001: Certificate and scope statement.
If most of your customers are in the US, SOC 2 is usually the first priority. If you sell internationally, ISO 27001 may carry more weight. Because the underlying controls overlap, many organisations build one control set and map it to both.
Choosing an auditor
Only an independent licensed CPA firm can issue a SOC 2 report. When choosing one:
- Ask about experience with companies of your size and type.
- Check whether customers in your target market recognise the firm.
- Agree the scope, criteria, timeline and fees in writing.
- Ask what evidence formats they accept, and whether they work with your tooling.
- Separate readiness advice from the audit itself. Auditors must stay independent, so readiness support usually comes from a different advisor.
Preparing your team for fieldwork
During fieldwork, the auditor will request samples and may interview staff. Before it starts, name a coordinator who owns all auditor requests, brief control owners on what they may be asked, and check that evidence is organised by control so it can be found quickly. Slow responses to sample requests are one of the most common reasons audits overrun.
Where companies struggle
- Access reviews skipped or undocumented
- Offboarding delays leaving former employees with access
- Unmanaged laptops with no encryption or patching evidence
- Logs collected but never reviewed
- Policies written for the audit and ignored in practice
Most of these are solved by identity, device management and centralised monitoring, the same building blocks as a Zero Trust programme. See our phased Zero Trust roadmap and guide to SIEM and managed detection.
How Atomquark.ai can help
Atomquark's IT consulting and cyber security services cover the control areas auditors look at most: cloud identity with SSO and MFA, privileged identity management, endpoint management, advanced threat protection, data protection and cloud-native SIEM, aligned to SOC 2, GDPR and ISO 27001 requirements. For organisations that want the full control stack implemented and managed, SecureShield delivers it as a 7-phase managed service. Policy, governance and audit-readiness work is supported by Atomquark's technology and operations consulting team, which uses ISACA- and ITAF-aligned governance frameworks.
Frequently Asked Questions
What are the 5 Trust Services Criteria for SOC 2?
Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is required in every SOC 2 report; the others are included based on your services and data.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 evaluates whether controls are suitably designed at a point in time. Type 2 evaluates whether they operated effectively over an observation period.
How long does SOC 2 compliance take?
For a first Type 2 report, many organisations take around nine to twelve months including readiness work and the observation period, though this varies widely.
Is SOC 2 required for Indian IT companies?
It is not a legal requirement in India, but many US and enterprise customers ask vendors for a SOC 2 report during procurement.
Who can issue a SOC 2 report?
Only an independent licensed CPA firm can perform a SOC 2 examination and issue the report.
Get audit-ready without the scramble
Clear scope, working controls and evidence collected as you go. Book a SOC 2 readiness review with Atomquark.ai.