What Service Organization Controls (SOC) reports are, what they aren’t, and how to be ready for one.
If you sell a service that touches customers’ data or financial reporting, it’s only a matter of time before someone asks whether you have a SOC report. When the question comes (and it will), there is often a scramble to understand what exactly the report is and what it is not. Is it a certification? Is it a checklist? Can we use our cloud provider’s report? Will it take two weeks?
In this article, I have debunked the most common myths about SOC reports and concluded with some readiness tips.
A 60-second primer
A SOC report is an attestation: an independent auditor reviews the controls a service organization has in place and shares their findings with the entities relying on that service.
There are three main types:
- SOC 1 covers controls relevant to your customers’ internal control over financial reporting.
- SOC 2 covers controls over security, availability, processing integrity, confidentiality and privacy, known as the Trust Services Criteria.
- SOC 3 is a separate, general-use report on the same Trust Services Criteria. It contains no detailed controls or test results, so it can be shared publicly.
SOC 1 and SOC 2 reports come in two types. A Type 1 report covers the design of controls at a single date. A Type 2 report covers both design and operating effectiveness over a period.
The myths
What a SOC report is, and isn’t?
“SOC is a certification.” This is the most persistent myth. SOC reports come out of an attestation engagement under the AICPA standards. A licensed CPA firm gives an opinion on the design of your controls and, for a Type 2, on their operating effectiveness over a period of time. You are not graded pass or fail, although the opinion can be modified (qualified, adverse or a disclaimer) if significant issues are found. So instead of saying “we’re SOC 2 certified,” say “we have a SOC 2 report.”
“SOC 1 and SOC 2 are interchangeable.” They answer different questions. SOC 1 focuses on controls relevant to your customers’ financial reporting, such as payroll processing or third-party administration. SOC 2 focuses on security, availability, processing integrity, confidentiality, and privacy. Ask which one your customers need and pick accordingly.
“SOC 2 means adopting all five criteria.” SOC 2 is built on the Trust Services Criteria: Security, Availability, Confidentiality, Processing Integrity, and Privacy. Only Security is mandatory. The rest are optional, and many organizations start with Security alone or add one or two where customers or contracts demand it. The fewer criteria you adopt, the lesser evidence you have to collect, but the narrower your report will be.
“SOC 2 hands you a checklist of required controls.” SOC 2 is non-prescriptive: you design controls that address your own risks and document them accurately in the system description. A single control, such as customer support training, can count towards more than one criteria. A data center and a SaaS application will have quite different controls, with physical access in the former and identity management, multi-factor authentication, and data segregation in the latter. Copying someone else’s controls can give you a false sense of security.
“It’s an IT project.” Many SOC 2 controls are IT-related, but finance, HR, operations, and legal add real value through vendor management, risk assessment, and personnel administration. SOC 2 is also aligned with the COSO framework: control environment, risk assessment, control activities, information and communication, and monitoring.
“SOC 2 and ISO 27001 are the same thing.” ISO 27001 is a certification of an information security management system, issued by an accredited certification body after an audit against the standard. A SOC 2 is a detailed report, describing your system, control environment, the auditor’s testing and any exceptions found. Both involve risk assessments, security policies and management oversight, so doing one makes the other easier. But neither replaces the other.
“A clean report means we can’t be breached.” A clean report (an unqualified opinion) is one part of a security strategy, not a guarantee. It reflects your controls during a defined period, configurations change, many controls are manual and open to human error, and the threat landscape keeps evolving.
“We can post the SOC report on our website.” SOC 1 and SOC 2 reports are restricted-use reports meant for specified parties, and are normally shared under NDA with those relying on your service. If you need something public, a SOC 3 is a separate general-use report that contains neither detailed control listings nor test results, which makes it suitable for a website.
Timing, cost, and effort
“We can have it in a few weeks.” A Type 2 needs your controls to operate for a period before testing can be completed, and the examination and report can take months. A Type 2 report in under a month is unlikely. A Type 1 can be faster, but only if your controls are already in place.
“A compliance platform will automate it.” SOC 2 is an information security program, not something you can automate. Integrations with your cloud provider can cover some technical settings, but they will not address most administrative and procedural controls. Tools help with collecting evidence. They do not build the program.
“It’s a one-time exercise.” A CPA firm only speaks to what it saw during the review period, while customers want ongoing assurance for the life of the contract. SOC is an ongoing exercise, and the examination should be repeated every year.
“We should go straight to a Type 2.” Skipping the readiness assessment and jumping to a Type 2 makes qualified opinions and testing exceptions more likely. A readiness review, or even a Type 1, helps you fix deficiencies before they are tested over time.
“A Type 2 has to cover 12 months.” Not necessarily. The AICPA sets no minimum period for a SOC 2 Type 2. CPA firms commonly want at least three months, and six months is a common window for a first report. SOC 1 periods are often 12 months so they cover a customer’s financial audit period, while shorter periods are common for SOC 2 to satisfy customer onboarding. Make sure the period you agree is acceptable to your customer.
“A Type 2 is much more work for us.” The effort shifts from building controls to producing evidence consistently. Much of the early effort goes into readiness: writing policies and mapping controls. During a Type 2, your main task is collecting operating evidence while the CPA firm samples and tests.
“It’s too expensive to be worth it.” There is a cost of time, people, and expertise. But most organizations already have a baseline of controls and need to improve documentation and bring practices up to a formal standard. As for value, customers often ask for a SOC 2 before a sale, and first-time requests usually arrive in the middle of a blocked enterprise deal. It is hard to quantify, but the value is rarely zero.
Key Truths
“Passing a SOC audit guarantees we’re secure.” A SOC report provides assurance over defined controls during a specific period. Security still requires ongoing monitoring, improvement, and risk management.
“Auditors are out to find problems.” They examine controls thoroughly, but they want the same thing you do: customer data that is truly protected. Pick an auditor you can work with, since you will be sharing a lot of information with them.
“Our cloud provider’s report covers us.” Running your application on a provider with its own SOC 2 doesn’t cover you, because of the shared responsibility model. Their report covers their part of the stack. Every company is responsible for its own part, and therefore for its own report.
“When we test a first-year Type 2, the exceptions rarely come from firewalls or encryption. They come from the quiet, manual controls: a quarterly access review that slipped a month, a terminated employee whose account stayed active for two weeks, a vendor review nobody signed off on. Teams that build those routines into their calendar early are the ones that end up with clean reports,” says Karan Trehan, Associate Director, Technology Risk Advisory.
Readiness tips
- Ask the prospect first, then pick the report. SOC requests are often a blocker for closing a sale, so talk to the customer early. Find out whether they want a SOC 1 or SOC 2, and whether a Type 1 or Type 2 with shorter coverage period would work. Offer a roadmap with dates, which reassures enterprise buyers and gives you time to implement controls.
- Start early and run a readiness assessment. Time is the cheapest resource you have, so give yourself enough lead time. A readiness review before any Type 2 helps you identify gaps, and starting early gives the work room to breathe.
- Take stock of what you already do. Most organizations have more controls in place than they think. They typically just need to document or tighten existing practices.
- Design controls for the services you offer and add criteria only when needed. Resist the temptation to build a master control list. Map your services to the criteria, start with Security (the only mandatory one), then add others as needed.
- Make it company-wide and build security first. Involve finance, HR, operations and legal, and get commitment from the board down to the lowest level involved. Audit evidence should be a byproduct of real policies, governance, and behavior, not the other way around.
- Be wary of claims about speed and automation. “SOC 2 in weeks” and “fully automated” are red flags. Use tools for evidence collection and monitoring, but budget time for the administrative and procedural controls that cannot be automated.
- Know your part in the shared responsibility model. List the cloud and third-party services you use, read their reports, and understand which controls are yours so you can own them in your report.
- Make evidence a habit, not an event. The CPA firm tests operations over a period of time, so collect evidence continuously, with extra care for manual controls, which are prone to human error.
- Plan for the next cycle. Schedule the next period as part of your planning. A report is a snapshot in time, and customers will want it to be updated.
- Communicate accurately. Say “we have a SOC 2 report,” not “we’re certified.” Share SOC 1 and SOC 2 reports only under NDA and use SOC 3 for anything that needs to be public.
- Do it for the right reason. Teams that treat SOC as an opportunity to strengthen the way they do business tend to have the smoothest examinations.
