What is SOC 2?
SOC 2 is an independent auditor’s report on how your company protects customer data. It is built on the AICPA Trust Services Criteria: security is always in scope, while availability, confidentiality, processing integrity and privacy are added when they fit your product. A Type I report looks at whether your controls are designed correctly at one point in time. A Type II report shows that they actually worked over an observation period, commonly six to twelve months, and it is the version most enterprise buyers expect.
Who needs it
- B2B software companies selling to US mid-market and enterprise customers
- Startups whose buyers send long security questionnaires
- European companies entering the US market
What usually triggers it
- A prospect’s security team asks for your SOC 2 report
- Procurement stalls until a report is in place
- You start selling into regulated US industries
How the process works
- Scope the systems and Trust Services Criteria that matter to your customers
- Close gaps: policies, access controls, monitoring, vendor management
- Collect evidence continuously, ideally through a compliance automation platform
- Type I audit for a point-in-time report, then a Type II observation period
- Independent CPA firm issues the report; you share it under NDA
How Holam helps
We work out whether SOC 2 is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
Is SOC 2 a certification?
No. SOC 2 is an attestation report written by an independent CPA firm. There is no certificate, but the report plays the same role in a sales process.
Type I or Type II first?
Many startups start with Type I to unblock deals quickly, then move to Type II. Ask your key prospects which one they accept.
Does SOC 2 overlap with ISO 27001?
Yes, substantially. Much of the control work can be reused, which is why many companies add ISO 27001 after SOC 2, or the other way round.