SOC 2 is an independent assurance examination of how a service organization manages customer data against five AICPA Trust Services Criteria. The output is a detailed report, not a formal certificate, that demonstrates the strength of an organization’s information security controls. Many clients now require this report before signing contracts, making it a core component of vendor risk management.
The average data breach now costs more than most organizations can absorb without lasting consequences. According to the 2025 IBM Cost of a Data Breach Report, conducted by the Ponemon Institute and based on data from March 2024 through February 2025, the global average cost fell to $4.44 million, while the United States average reached a record $10.22 million. Those figures explain a shift that procurement and compliance teams across the industry are already responding to. Enterprise buyers are asking vendors to demonstrate their security posture before contracts are signed. For many technology and service providers, the documentation clients request is a SOC 2 report.
This guide explains what SOC 2 means, what the examination covers, and how the audit process works. You will also find guidance on who needs it, the mistakes that most commonly delay organizations, and how independent assurance converts a security claim into verifiable evidence.
What SOC 2 Actually Means
SOC 2 is an independent assurance examination, not a license, a product approval, or a pass or fail badge. It was developed by the American Institute of Certified Public Accountants, which is why you will often see it described as an AICPA SOC 2 examination. The resulting report describes the controls a service organization uses to protect customer data and provides an independent auditor’s opinion on how well those controls are designed and, in some cases, how consistently they operate.
The term “SOC 2 certification” is widely used in commercial and procurement conversations, but it would be more precise to describe the output as an examination report signed by a licensed CPA firm. This does not make the process informal or lightweight. A SOC 2 examination follows the AICPA’s attestation standards and produces documented evidence that clients, regulators, and cyber insurers treat as meaningful.
Importantly, the examination focuses on the specific systems and processes that handle customer information. That targeted scope is what makes SOC 2 relevant to vendor security reviews and what distinguishes it from broader frameworks that assess organizational maturity at a higher level.
The Five Trust Services Criteria
SOC 2 is structured around five Trust Services Criteria defined by the AICPA. Security is the only required criterion. The remaining four are included based on the specific commitments a service organization makes to its clients and the nature of the services it provides.
- Security: Controls that protect systems and data against unauthorized access, including logical access controls, firewalls, intrusion detection, and monitoring.
- Availability: Controls that support system availability in line with agreed service commitments, including backup procedures, disaster recovery plans, and performance monitoring.
- Processing Integrity: Controls that confirm system processing is complete, valid, accurate, timely, and authorized, so that data is handled exactly as intended.
- Confidentiality: Controls that protect information designated as confidential throughout its storage, processing, and disposal lifecycle.
- Privacy: Controls governing how personal information is collected, used, retained, disclosed, and disposed of, consistent with an organization’s stated privacy commitments.
You do not need to include all five criteria in a single examination. Most organizations begin with Security and add additional criteria where their services and client obligations make them relevant.
SOC 2 Type 1 vs SOC 2 Type 2
There are two distinct report types, and the difference between them carries real weight in enterprise procurement discussions.
- SOC 2 Type 1 examines the design of controls at a specific point in time. It addresses one question: are the right controls appropriately designed and in place as of the report date?
- SOC 2 Type 2 examines both the design and the operating effectiveness of controls across a defined observation period, most commonly six to twelve months. It addresses a harder question: did those controls function consistently and as intended over time?
Type 1 is often the first step for organizations that have not yet completed an examination, as it establishes a documented baseline. Type 2 carries more weight with enterprise buyers because it demonstrates that controls held up under real operating conditions across an extended period. Neither report type is universally superior. The appropriate choice depends on your current state of readiness, your timeline, and the specific requirements of your clients.
Who Needs SOC 2 Certification
SOC 2 applies to service organizations that store, process, or transmit customer data on behalf of other businesses. This does not necessarily mean only large enterprises. A growing SaaS company handling client records can face the same security due diligence questions as a long established data center operator.
Organizations commonly asked to produce SOC 2 reports include:
- Cloud platforms and SaaS providers subject to enterprise security due diligence
- Data centers and managed IT service providers
- Fintech and payment processing companies
- Healthcare technology platforms that handle protected information
- Analytics, HR, and marketing technology vendors that hold client data
If a prospective client’s security or procurement team requests independent assurance during vendor onboarding, a SOC 2 report is frequently the specific documentation they are requesting.
Why the Regulatory Climate Is Raising the Stakes
Compliance expectations for data security and supply chain accountability are tightening across major markets. In the United States, SEC cybersecurity disclosure rules, effective for annual reports covering fiscal years ending on or after 15 December 2023, require public companies to report material cybersecurity incidents and describe their risk management processes and governance in their annual filings. This extends scrutiny to the vendors and service providers those companies rely on.
In the United Kingdom, the government published its Cyber Security and Resilience policy statement on 1 April 2025, setting out plans for new legislation that would expand the scope of existing regulations to cover managed IT service providers and certain critical suppliers. The statement also proposes embedding supply chain security requirements directly into the regulatory framework.
The direction across these markets is consistent. Regulators are placing greater responsibility on organizations to demonstrate that their suppliers and service providers meet defined security standards. A SOC 2 report provides documented, independently verified evidence that supports that obligation.
How the SOC 2 Audit Process Works
The examination follows a defined sequence. Understanding the steps helps you plan your timeline and allocate resources appropriately.
- Define scope. Identify which Trust Services Criteria and which systems and services the report will cover.
- Conduct a readiness assessment. Compare your current controls against SOC 2 requirements to identify gaps before the formal examination begins.
- Remediate identified gaps. Strengthen controls, document policies and procedures, and put missing processes in place.
- Select the report type. Decide between Type 1 and Type 2 based on your readiness and the requirements of the clients you are targeting.
- Complete the examination. A licensed, independent CPA firm tests your controls and collects supporting evidence.
- Receive the report. The completed report is issued and can be shared with clients under a confidentiality agreement.
For a Type 2 report, the observation period begins after controls are in place. Organizations that start the process earlier have more time to build a clean evidence record before the formal examination window closes.
Common Mistakes That Delay Organizations
Most delays in completing a SOC 2 examination trace back to a small number of recurring errors.
- Treating the examination as a documentation exercise. Controls must function in practice. Written policies that are not followed in day to day operations will not satisfy an auditor testing operational effectiveness.
- Scoping too broadly at the outset. A focused first report covering core systems is more manageable and more achievable than one that attempts to include every service from the start.
- Failing to collect evidence consistently. Type 2 examinations depend on records that demonstrate controls operated throughout the entire observation period, not just at the beginning or end.
- Skipping the readiness assessment. Organizations that proceed directly to audit without a prior gap review frequently encounter findings that extend timelines and increase costs.
The Business Risk of Waiting
Delay carries a measurable commercial cost. Procurement decisions stall when a buyer’s security team places a hold on a contract pending receipt of a SOC 2 report. Extended sales cycles have direct revenue consequences, particularly where enterprise deals are involved. Given the breach costs documented in the 2025 IBM report and the regulatory developments in the US and UK, organizations that delay independent security assurance face growing commercial and compliance exposure simultaneously.
How Independent Assurance Builds Client Trust
A self assessment of internal controls carries limited credibility in a vendor review. An independent report carries considerably more, because a qualified external auditor, not the organization’s own team, conducted the testing and formed the opinion. That independence is what gives SOC 2 its value in vendor risk management. It reduces the time clients spend on security questionnaires, provides documented answers to due diligence inquiries, and demonstrates that security controls are subject to external scrutiny rather than internal self reporting alone.
How IRQS Supports Your SOC 2 Readiness
IRQS provides certification, assurance, and cybersecurity services to organizations across a range of sectors. For organizations working toward SOC 2 readiness, IRQS offers gap assessment support, control readiness reviews, and guidance on the broader information security work that underpins a credible examination outcome.
Many organizations pursuing SOC 2 are also managing ISO management system requirements or other compliance obligations. Aligning that existing work with SOC 2 preparation, where the controls and documentation overlap, can reduce duplication and make the overall compliance effort more efficient.
IRQS does not make unsupported claims about speed or outcome. What it provides is structured, professional support from a team with direct experience in certification and assurance processes, so that you understand your current position clearly and can take a planned, evidence based approach to the examination.
Take the Next Step
SOC 2 certification has become a standard expectation for many service providers, not an optional differentiator. Understanding the Trust Services Criteria, selecting the right report type, and building a consistent evidence record from early in the process are the factors that determine how smoothly an examination runs. Each of those decisions is easier to make when you have a clear picture of where your controls stand today.
To discuss your SOC 2 requirements and understand what a readiness assessment would involve for your organization, contact IRQS to speak with a specialist about certification and assurance services.
