SOC 2 is an attestation report, issued by an independent licensed CPA firm, that evaluates how a service organisation protects customer data against the AICPA's Trust Services Criteria. A SOC 2 compliance checklist is the set of controls, policies and evidence you need in place before that audit. There's no "SOC 2 certificate": you receive a report describing your controls and the auditor's opinion on them.
Most companies start the SOC 2 journey for one reason. A big customer's security team sent a questionnaire, and somewhere on page two it asked for your SOC 2 Type 2 report. The deal now depends on it.
The good news is that SOC 2 isn't mysterious. It's mostly good security hygiene, written down and proven over time.
Plain answer: To get SOC 2 ready, pick your scope and criteria, close control gaps (access, change management, monitoring, vendor risk, incident response), write the policies, collect evidence automatically, then book a CPA firm.
SOC 2 Type 1 vs Type 2
- What it tests — Type 1: whether controls are designed properly at a point in time. Type 2: whether controls operated effectively over a period.
- Observation period — Type 1: none (single date). Type 2: typically 3 to 12 months.
- Customer value — Type 1: useful first step. Type 2: what most enterprise buyers ask for.
- Effort — Type 1: lower. Type 2: higher; requires sustained evidence.
Many companies do a Type 1 first to unblock deals, then move straight into the Type 2 observation window.
The Five Trust Services Criteria
The AICPA's SOC 2 framework is built on five criteria. Only Security is mandatory:
- Security (required): protection against unauthorised access. Also called the Common Criteria.
- Availability: systems are available as committed in contracts or SLAs.
- Processing integrity: processing is complete, accurate and authorised.
- Confidentiality: confidential information is protected as agreed.
- Privacy: personal information is handled according to your privacy notice.
Choose the criteria your customers actually care about. Adding all five on a first audit multiplies the work.
The SOC 2 Compliance Checklist
Governance and policies
- Information security policy approved by leadership
- Defined roles: security owner, control owners
- Risk assessment performed and documented at least annually
- Code of conduct and acceptable-use policy acknowledged by staff
- Security awareness training on hire and annually
Access control
- Central identity provider with SSO for in-scope systems
- MFA enforced for all users, especially admins and production access
- Role-based, least-privilege access with documented approvals
- Timely removal of access for leavers
- Quarterly access reviews for production and sensitive systems
Our identity and access management best practices guide covers these controls in depth.
Change management and development
- Code changes go through version control and peer review
- Separation between development, testing and production
- Testing before release, with records retained (see our test automation strategy guide)
- Approved, documented deployment process
Infrastructure and endpoint security
- Encryption of data at rest and in transit
- Endpoint protection and device management with disk encryption, covered in our endpoint MDM guide
- Vulnerability scanning and timely patching
- Secure network configuration and firewall rules
Monitoring and incident response
- Centralised logging and alerting, often via a SIEM
- Documented incident response plan, tested at least annually
- Uptime and capacity monitoring if Availability is in scope
Vendor and data management
- Inventory of vendors with access to customer data
- Vendor risk reviews, including their SOC 2 reports
- Data retention and secure disposal procedures
- Backups with tested restores
How Long Does SOC 2 Take?
A realistic plan for a company starting with reasonable security basics:
- Gap assessment and scoping — 2 to 4 weeks
- Remediation and policy writing — 1 to 4 months
- Type 1 audit — a few weeks
- Type 2 observation period — 3 to 12 months
- Type 2 report issued — a few weeks after the period ends
Companies with weak identity, logging or change management controls should expect remediation to take the longest.
SOC 2 vs ISO 27001
SOC 2 is an attestation report common with US customers. ISO/IEC 27001 is a certifiable international standard for an information security management system, more common in Europe and Asia. Controls overlap substantially, so many companies build one control set and map it to both. Selling into both regions? Plan for both from the start.
Mistakes That Delay SOC 2
- Scope creep. Including every system and all five criteria on the first audit.
- Manual evidence. Screenshots collected the week before the audit. Automate evidence collection.
- Policies nobody follows. Auditors test practice, not paperwork.
- Ignoring vendors. Your cloud and SaaS providers are part of your control environment.
Practical Example: A SaaS Company's Path to Its First Type 2
An illustrative timeline for a 60-person B2B SaaS company asked for SOC 2 by an enterprise prospect:
- Month 1: Scope and gap assessment. Scope covers the production platform, the support tooling and the people with production access. Criteria: Security plus Availability, because the customer contract includes uptime commitments. The gap list shows the usual suspects: no formal access reviews, shared admin credentials on one legacy server, no tested incident response plan, and no vendor inventory.
- Months 2 to 4: Remediation. SSO and MFA across all in-scope systems; shared credentials replaced with named accounts and a password vault; pull-request reviews enforced on the main branch; centralised logging with alerts; policies written and acknowledged; a tabletop incident exercise run and documented; vendor list built with each vendor's own SOC 2 report collected.
- Month 5: Type 1. The auditor confirms controls are designed appropriately. The sales team shares the report with the prospect under NDA along with a bridge letter.
- Months 6 to 11: Observation period. Controls run as designed; evidence is collected automatically wherever possible.
- Month 12: Type 2 report. The company now has the document most enterprise buyers ask for, and the controls behind it.
Conclusion
SOC 2 rewards companies that make security routine: one identity provider, MFA, reviewed changes, monitored systems, managed vendors and evidence collected continuously. Scope tightly, close the gaps, then let the observation period prove the controls work.
Atomquark doesn't issue SOC 2 reports (only licensed CPA firms can), but our IT consulting and cyber security team helps you get ready: gap assessments, control implementation and the identity, endpoint, DLP and SIEM layers delivered through SecureShield. Get a SOC 2 readiness assessment.
Frequently Asked Questions
What is SOC 2 compliance?
SOC 2 compliance means a service organisation has controls that meet the AICPA Trust Services Criteria, verified by an independent CPA firm in a SOC 2 report. It shows customers how their data is protected.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report assesses whether controls are properly designed at a single point in time. A Type 2 report tests whether those controls operated effectively over a period, typically three to twelve months.
How long does it take to get SOC 2?
A Type 1 report can often be achieved within a few months of starting. A Type 2 report usually takes six to fifteen months overall, because it requires an observation period after controls are in place.
Who can perform a SOC 2 audit?
Only licensed CPA firms can perform SOC 2 examinations and issue reports. Consultants and software platforms can help with readiness, controls and evidence, but cannot issue the report.
Is SOC 2 mandatory?
SOC 2 is not legally required. It is a market expectation, commonly required by enterprise customers before they share data with SaaS and IT service providers.
Can a company outside the US get SOC 2?
Yes. Companies in India, Europe and elsewhere routinely obtain SOC 2 reports from CPA firms qualified to perform them, usually because their customers are in the US or follow US security standards.