Information security
SOC 2
SOC 2 (System and Organization Controls 2)
SOC 2 is an independent audit of how you protect customer data against the Trust Services Criteria. We take you from first gap to a clean Type I or Type II report.
What SOC 2 is
SOC 2 is an attestation report produced by an independent CPA firm that describes how your organisation manages customer data against five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always in scope; the others are included when they matter to your service.
A Type I report assesses whether your controls are suitably designed at a point in time. A Type II report tests whether they actually operated effectively over a period, usually three to twelve months, and is the one most enterprise buyers expect.
The structure of the standard
Criterion · Security
The common criteria that every SOC 2 engagement includes, covering how systems and data are protected from unauthorised access.
Criterion · Availability
Optional criteria addressing whether the system is available for operation and use as committed or agreed.
Criterion · Processing integrity
Optional criteria addressing whether system processing is complete, valid, accurate, timely and authorised.
Criterion · Confidentiality
Optional criteria addressing how information designated as confidential is protected through its lifecycle.
Criterion · Privacy
Optional criteria addressing how personal information is collected, used, retained, disclosed and disposed of.
Report · Type I
An assessment of whether controls are suitably designed at a single specified date.
Report · Type II
An assessment of whether those controls also operated effectively across a defined review period.
Who needs it
- SaaS and B2B software companies whose customers store data with them
- Anyone being asked for a SOC 2 report in a security questionnaire or deal
- Teams selling into US enterprises where SOC 2 is the default expectation
What you get
- A gap assessment and prioritised roadmap
- Policies, controls and an evidence set mapped to the criteria
- Penetration test and security review evidence
- Audit preparation and support to a clean Type I or Type II report
Timelines depend on your starting point and whether it is Type I or Type II. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
SOC 2 reports are prepared against the AICPA Trust Services Criteria, the 2017 edition with its points of focus revised in 2022, read together with the attestation standards in SSAE 18. The criteria themselves are stable, so the current framework is what any new engagement works to today. The practical change over time is in auditor expectations and evidence, so the sensible approach is to confirm the current criteria and your auditor's scoping before fieldwork rather than assume last year's set carries over unchanged.
What it costs
Two costs sit side by side here. tr3labs charges a scoped advisory and implementation fee, quoted up front once we understand your size, your systems and how far along your controls already are. Separately, the independent licensed CPA firm that performs the examination and issues the report charges on its own schedule, because tr3labs is never the auditor and never issues the attestation. We would rather scope the work with you than quote blind.
How tr3labs gets you there
Scope and gap assessment
We agree which Trust Services Criteria apply, map your current controls against them, and hand you a prioritised roadmap to close the gaps.
Build the controls
We help you implement the policies, processes and technical controls the criteria expect, and gather the evidence your auditor will want to see.
Test and prove
Our penetration testing and reviews provide the security evidence behind the controls, and we dry-run the audit so there are no surprises.
Audit support
We work alongside your CPA auditor through fieldwork to a clean report, and keep you ready for the next period.
SOC 2 compared with ISO 27001
Both prove you manage information security to an outside party, which is why buyers often treat them as interchangeable.
| SOC 2 | ISO 27001 | |
|---|---|---|
| Covers | Controls against the Trust Services Criteria | A managed information security management system |
| Who asks for it | Mostly US enterprise buyers and procurement | International customers and regulators |
| Core idea | Attestation report on your controls | Certifiable management system you run and improve |
| Audit model | Examination by an independent CPA firm | Two-stage audit by an accredited certification body |
| Result | A Type I or Type II report, not a certificate | A certificate with surveillance audits |
| Often held with | ISO 27001, where buyers span both regions | SOC 2, to satisfy US as well as global buyers |
SOC 2 FAQ
- How much does SOC 2 cost?
- Two costs sit side by side: our scoped advisory and implementation fee, quoted up front once we understand your size and starting point, and the separate fee the independent CPA firm charges to examine your controls and issue the report. tr3labs is never the auditor, so we scope our part with you rather than quote blind.
- How long does SOC 2 take?
- There is no fixed number of weeks. It depends on your starting point and whether you are going for a Type I or a Type II report, so we scope the timeline honestly with you up front.
- What is the difference between SOC 2 Type I and Type II?
- Type I assesses whether your controls are designed correctly at a single point in time. Type II tests whether they operated effectively over a review period, usually three to twelve months, and is what most enterprise buyers ask for.
- Do we need a penetration test for SOC 2?
- SOC 2 does not mandate a specific test, but auditors and customers expect real evidence that your security controls work. Our manual penetration testing provides exactly that and feeds straight into the report.
- Who issues the SOC 2 report?
- An independent licensed CPA firm issues the report. tr3labs prepares you for the audit, builds the controls and evidence, and supports you through it; we do not issue the attestation ourselves.
The services that get you there
Related standards
Related reading
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read
What Is SOC 2 Compliance? A Plain-English Guide
SOC 2 explained without the jargon: what it is, the five Trust Services Criteria, Type I vs Type II, who needs it, what the process looks like, and how to prepare.
7 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read