Why organizations pursue SOC 2.
- Enterprise procurement. Many enterprise buyers request a SOC 2 report before approving a vendor.
- Faster security reviews. A current report can reduce back-and-forth on security questionnaires and shorten review cycles.
- Vendor risk approval. Third-party risk teams frequently use the report as a baseline for vendor due diligence.
- Customer trust. The report gives prospects independent assurance about how you handle their data.
- Market expectation. In much of B2B software, a SOC 2 report has become a common expectation rather than a differentiator.
Context
SOC 2 does not guarantee a closed deal or a passed review. It removes a common obstacle, and for many companies that obstacle is what stalls revenue. The mechanics below explain what the report actually is and how to approach it.
One report.
Every control domain it touches.
- Identity & Access
- Change Management
- Vendor Risk
- Security Operations
- Risk Management
- Governance
- Evidence Collection
- Audit Readiness
SOC 2 exists because enterprise buyers need confidence that governance, identity, evidence, vendor oversight, and security operations operate as one system.
What SOC 2 actually is, in plain English.
A CPA-signed opinion on whether your controls actually work — an attestation, not a certification. No certificate, no badge, no public registry.
The standard, in full
SOC 2 is a report a licensed CPA firm writes about your service organization. It states, in writing, whether the controls you described to them: the policies, the encryption, the access reviews, the change management, the vendor due diligence: were either suitably designed at one point in time (Type 1), or operated effectively across a window of three to twelve months (Type 2).
It is governed by the AICPA's SSAE 18 attestation standard, specifically AT-C section 205. The criteria are the 2017 Trust Services Criteria, last revised 2022: seventeen common criteria for security, plus four optional categories (availability, confidentiality, processing integrity, privacy). SOC 2 is an attestation, not a certification: there is no certificate, no public register, and the AICPA does not publish a list of compliant firms. The deliverable is a private report, signed by the auditor, carrying one of four opinions: unqualified (clean), qualified (specific exceptions), adverse, or a disclaimer.
Enterprise procurement, cleared.
A qualified prospect wants to buy. Nothing is in the way: yet.
Their security team asks for your SOC 2 report. With a current Type 2 in hand, the review opens instead of stalling.
Third-party risk reviews the report, not a 200-line questionnaire. Weeks come off the cycle.
Procurement has the independent assurance it needs to proceed. No back-and-forth.
The deal advances. Cleared.
All cleared. A current SOC 2 Type 2 compresses this journey from months to days.
SOC 2 compresses this cycle from months to days.
A boutique firm, not a compliance factory.
- Canned SOW, identical for every client
- Junior associate does the work, partner sells it
- Scope padded with line items you don't need
- "You don't qualify" if you don't fit the template
- Surprise change-orders mid-engagement
- SOW built around your business, not a template
- Senior practitioner from day one: no junior hand-off
- We cut unnecessary cost: you pay for what moves the audit
- We edit SOW language together until both sides agree
- Fixed fee, written: no surprise change-orders
We never say "you don't qualify."
Our approach
If a framework isn't right for you yet, we'll tell you: and tell you what is. When it is right, we sit down and shape the statement of work to your reality: your stack, your team, your timeline, your budget. The deliverable bends to your business. You do not bend to a canned deliverable.
Does this apply to you?
A two-question filter we run on every intake call. If you answer "yes" to either, you are almost certainly going to be asked for a SOC 2 Type 2 within twelve months.
SOC 2 scope check
Controls designed.
Not yet operating.
Evidence begins
accumulating.
Operating effectiveness established.
Clean Type 2
in hand.
A Type 1 report captures your controls at one point in time. It proves suitably-designed controls exist — not that they’re running.
The audit period opens. Controls must now operate. Evidence is captured continuously — not assembled at year-end.
Month over month, evidence accumulates. The CPA tests effectiveness across the full period. No scrambles — the evidence was already there.
An unqualified opinion: your controls operated effectively. This is the report enterprise procurement asks for before they sign.
A first-time Type 2, realistically: 8 to 14 months.
From kickoff to a clean report in your buyer's hands. The chokepoint is almost never the audit; it’s readiness, evidence, and the audit period itself.
Wk 0 – 4Readiness assessment
Wk 4 – 16Remediation
Wk 16+Audit period begins
Wk 28 – 52Fieldwork
+ 6 wksReport issued
Senior partner from day one. ConMon from week one.
Partner-led from kickoff through fieldwork. ConMon-instrumented from week one. Audit-room delivered before fieldwork opens.
Methodology detail
Most readiness firms hand you a policy template library and a SaaS portal, then stop calling. We don’t. Every Nexurion SOC 2 engagement is led by a senior practitioner: the person on the engagement letter is the person reading evidence, sitting in your week-over-week stand-ups, and on the call when the auditor finds a sample they want to escalate. Read our methodology.
From day one we instrument continuous monitoring against your control library: not a quarterly evidence sweep. Access reviews trigger automatically; vendor due-diligence renewals show in a queue; change-management metadata is captured at PR-merge time, not at year-end. When the auditor walks fieldwork, we hand them a read-only audit-room with every artifact pre-mapped to the TSC control it satisfies. Sample requests turn around in hours, not days. More on ConMon »
The goal is not only a clean Type 2. It is a control environment that is sustainable: cheaper and lower-effort to operate in year two than in year one, and durable across renewals as the company grows.. See engagement outcomes.
Independent of the auditor: by design.
We are not a CPA firm and we do not issue SOC 2 reports. That independence is non-negotiable: a readiness partner whose firm also signs the opinion has a conflict no engagement letter can paper over. We work alongside the CPA firm of your choice: or recommend one of the three we’ve had clean engagements with. Auditor relationships »
Six places a SOC 2 goes sideways.
After running a few dozen of these, the failure modes are remarkably consistent. None are technical. All are organizational.
"Type 1 by end of quarter."
Why it happens
"Just everything, right?"
Why it happens
Collecting everything, mapping nothing.
Why it happens
Sub-processors nobody owns.
Why it happens
Off-boarding by memory.
Why it happens
A $50/hr CPA signing a $5M ARR report.
Why it happens
CPA firms we’ve walked clean engagements with.
How we work with auditors
We are auditor-neutral by policy and refer based on fit, sector, and partner-level relationships: never on referral fees (we accept none). After multiple engagements together you learn which firms turn around evidence requests in days versus weeks; which ones write conservative versus precise system descriptions; which ones bring sector-specific partners. We’ll introduce you to three firms with active partner relationships, calibrated to your stage and sector. Buyers care about the firm name on the cover: we make sure that name is one they recognize.
If you already have an auditor: we’ll sit with their senior on a kick-off and align on scope, evidence format, and walk-through cadence. We’ve never had to disengage from an auditor mid-fieldwork.
SOC 2 against the rest of the stack.
SOC 2 is rarely the only framework your buyers ask for. The good news: most criteria overlap. The bad news: the gaps are not where you think.
SOC 2 against the rest of the stack.
SOC 2 is the start, not the end.
| Framework | Overlap with SOC 2 | What you still need to do |
|---|---|---|
| ISO 27001 | ~85%: Annex A controls map cleanly to most CC. | Statement of Applicability, ISMS scope, three-year cert cycle, internal audit program. |
| HIPAA | ~60%: security rule covered by CC + Confidentiality. | BAAs, breach-notification procedures, minimum-necessary rule, OCR-specific risk analysis. |
| PCI DSS v4 | ~50%: CC6 / CC7 cover much of access & ops. | Cardholder-data scoping, network segmentation, ASV scans, prescriptive 4.0 controls. |
| HITRUST CSF | ~70%: most TSC controls have a HITRUST equivalent. | Sector-specific assessments, MyCSF assessment, e1 / i1 / r2 maturity scoring. |
| NIST 800-171 | ~65%: significant overlap on access & CM. | CUI marking, system security plan, POA&M, supply-chain controls. |
| GDPR | ~30%: Privacy TSC partial; SOC 2 isn’t a privacy framework. | Lawful basis, DPIAs, controller / processor split, cross-border transfers, DSARs. |
| ISO 42001 (AI) | ~25%: orthogonal to AI risk management. | AIMS, AI impact assessment, model lifecycle, third-party AI inventory. See governance » |
The five Trust Services Criteria.
Security is mandatory: the seventeen Common Criteria (CC1-CC9) every report must include. The other four are scoped in only when a buyer requires them or your service materially handles that domain. Click each to drill into the controls a CPA will test.
RequiredCommon Criteria: Security
The 17 controls every SOC 2 report includes. Mapped to COSO 2013 internal-control principles. This is the foundation: governance, risk assessment, monitoring, communication, control activities, logical and physical access, system operations, change management, and risk mitigation.
OptionalAvailability: uptime & recovery
Required when contracts include SLAs, when buyers ask about RPO/RTO, or when uptime is the product. Tests resilience and disaster recovery.
OptionalConfidentiality: information classification
For organizations handling material defined as confidential by contract: IP, source code, business secrets, financial data. Distinct from "privacy" (personal information).
OptionalProcessing Integrity: did the system do what it claimed?
Most relevant for FinTech, ledger systems, calculations, healthcare claims engines. Tests whether system processing is complete, valid, accurate, timely, authorized.
OptionalPrivacy: collection through disposal
Generally not the right path for privacy compliance: most clients are better served by ISO 27701 or direct GDPR / state privacy mapping. But buyers in healthcare and education sometimes require it explicitly.
What changed since the 2022 revision.
The AICPA last revised the Trust Services Criteria in 2022; the underlying 2017 TSC remain the working baseline. The points-of-focus were rewritten to be less prescriptive: a double-edged change that gave good firms more room and gave bad firms more excuses. The big shifts auditors are emphasizing in the 2026 cycle:
- AI risk under CC3 / CC9. Auditors increasingly ask how you assessed AI / LLM features in your risk register, even where AI isn’t in scope of the report. Our AI Governance practice handles the bridge.
- Third-party / sub-processor scrutiny. CC9 deficiencies have driven the most exceptions in the last 18 months. Sub-processor inventory is now table-stakes.
- Continuous monitoring evidence. Auditors prefer system-generated evidence over screenshot files. ConMon is no longer optional.
- Privacy bridge. Buyers asking for SOC 2 + Privacy often get better-served by SOC 2 + ISO 27701; we can scope a hybrid.
Read our deeper take in Field Notes Vol. II: "What auditors are testing in 2026 that they weren’t in 2024."
SOC 2 is rarely the last framework.
A short list of what we typically scope alongside it: in order of how often the question comes up.
Frequently asked.
Are we certified when the report is issued? +
How long does the first Type 2 take? +
What does it cost? +
Should we run SOC 2 and ISO 27001 at the same time? +
Can we self-attest? +
Does our existing HITRUST or ISO 27001 cert satisfy a SOC 2 ask? +
What’s the difference between SOC 1, SOC 2, and SOC 3? +
Field notes on SOC 2.
Pieces from Nexurion Field Notes directly relevant to the standard.