SOC 2 is an AICPA attestation report showing that a service organisation's controls meet the Trust Services Criteria.

What's the difference between SOC 2 Type 1 and Type 2?

Type 1 assesses controls at a single point in time; Type 2 assesses how effectively those controls operate over a period, usually 6-12 months.

Is SOC 2 legally required?

No, it's not a legal requirement, but it's often a contractual requirement for winning enterprise and SaaS customers in the US.

SOC 2 vs ISO 27001 - which do I need?

SOC 2 is more common with US enterprise buyers; ISO 27001 is more recognised internationally. Many companies pursue both.

🇺🇸 Americas

SOC 2 Compliance

Prove your security controls to enterprise customers

SOC 2 is an AICPA attestation framework built on five Trust Services Criteria, security, availability, processing integrity, confidentiality, and privacy. A Type I report checks controls at a point in time; a Type II report checks their effectiveness over 6–12 months. It's the standard proof point US enterprise customers expect from SaaS vendors.

Global

Standard scope

Trust services categories

6-12m

Typical Type II window

Any

Sector or size

Mandatory common criteria

What is SOC2?

SOC 2 is an attestation framework developed by the AICPA, built
around five Trust Services Criteria: security (mandatory),
availability, processing integrity, confidentiality, and privacy. A Type
I report assesses controls at a point in time; a Type II report
assesses their operating effectiveness over a period, typically 6–12
months.

Who needs to comply with SOC 2?

Service organisations, particularly SaaS companies and
cloud providers, that store, process, or transmit customer data
and need to demonstrate strong controls to enterprise customers.

What are the key requirements
of SOC 2?

Defining the scope and applicable Trust Services Criteria for your report

Implementing and documenting controls across security, access management, change management, and monitoring

Operating those controls consistently over the audit period (for Type II)

Engaging a licensed CPA firm to perform the audit

Remediating any exceptions identified during testing

What are the penalties for SOC 2 non-compliance?

There's no regulatory fine for not having SOC 2, but you'll likely lose enterprise deals, fail vendor security questionnaires, and face slower procurement cycles without it.

Contáctanos

Lost enterprise deals

Enterprise buyers increasingly require AIMS proof

Failed vendor assessments

Security questionnaires you can't pass

Slower procurement cycles

AI risk reviews stall procurement

How does GDPRLocal help with SOC 2?

GDPRLocal supports you with everything SOC 2 requires: scoping your report, building and documenting controls, running readiness assessments, and preparing for both Type I and Type II audits with a licensed CPA firm.

Empezar gratis