SOC 2: The Complete Executive Guide
What SOC 2 actually is, how the audit process works, and how to avoid the most common mistakes that turn a straightforward attestation into a stalled deal cycle.
SOC 2 is an attestation report, not a certification — there is no pass/fail certificate, and the deliverable is the auditor's opinion itself.
Executive summary
SOC 2 is an attestation, not a certification — a licensed CPA firm's opinion on whether an organization's controls, measured against the AICPA's Trust Services Criteria, were suitably designed and, for a Type II report, operating effectively over a real six-to-twelve-month observation period. There is no pass/fail certificate; the deliverable is the report itself, shared under NDA with prospective customers. Security is mandatory in every report; Availability, Processing Integrity, Confidentiality, and Privacy are scoped in only where they match a real promise the service makes. For a SaaS company selling to US mid-market and enterprise buyers, a Type II report is frequently the single artifact that unblocks a stalled security review — its absence doesn't always lose the deal, but it reliably adds real cycle time. The auditor's fee is the smallest, most visible cost; continuous evidence collection across the observation period and the control-implementation work behind it are the real, recurring costs. This guide covers who actually needs SOC 2 versus ISO 27001 versus both, how to choose an auditor, what fieldwork actually samples, a realistic maturity model for timing a first Type II attempt, and how bridge letters keep coverage continuous between reports.
Key findings
SOC 2 is an attestation, not a certification — there is no pass/fail certificate, only the auditor's opinion in the report itself.
Type II, covering a real 6–12 month observation period, is what most serious enterprise buyers actually expect — Type I is a weaker stopgap.
A control implemented once can satisfy both SOC 2's Common Criteria and the equivalent ISO 27001 Annex A control with the same evidence.
The absence of a report doesn't always lose a deal outright, but it reliably adds real cycle time through custom security review.
Evidence has to be generated across the entire observation period as controls actually run — fieldwork sampling is specifically designed to catch evidence manufactured retroactively before the audit.
A bridge letter covers the gap between a report's end date and the next one's fieldwork — a standard, proactive tool, not a sign something is wrong.
Moderate
3–12 months, depending on Type I vs. Type II
Security team
Written for founders, CISOs, and Compliance Directors preparing for a first SOC 2 report or evaluating whether Type I or Type II is the right target.
Independent CPA firm attestation
Contractual requirement
September 18, 2026
v2
35 min
What SOC 2 Is, and Isn't
SOC 2 is an attestation, not a certification. A licensed CPA firm examines an organization's controls against the AICPA's Trust Services Criteria and issues an opinion on whether those controls were suitably designed — and, for a Type II report, operating effectively over a real observation period.[1] There is no pass/fail "SOC 2 certificate" the way there is an ISO 27001 certificate; the deliverable is the report itself, along with the auditor's opinion, a description of the system, and the results of the auditor's testing.
Because there's no certificate, SOC 2 reports are typically shared only under NDA with a prospective customer's security team, not published publicly the way an ISO 27001 certificate number can be. This has a real practical consequence: the report's contents — including any noted exceptions — are visible only to buyers who actually request and review it, which is a meaningfully different disclosure posture than a certification's public verifiability.
Continue with the complete Executive Guide
14 more sections, written out in full — not previews
6 more diagrams and illustrations
7 comparison tables and reference matrices
1 decision-tree walkthrough
Executive Checklist, Implementation Roadmap & Audit Worksheet
The complete, board-ready PDF
Who Needs SOC 2, and the ISO 27001 Decision
SOC 2 is the default expectation for US mid-market and enterprise SaaS buyers; growing numbers of larger buyers ask for both SOC 2 and ISO 27001.
The Trust Services Criteria, In Depth
Security is mandatory in every report; the other four categories should be scoped in only where they match a real promise your service makes customers.
Type I vs. Type II
Type II — operating effectiveness over a real observation period — is the report almost every serious enterprise buyer actually wants; Type I is a faster stopgap, not the real target.
Business Impact
The auditor's fee is the smallest, most visible cost — continuous evidence collection across the observation period is the real, recurring operational cost.
The Audit Process, Step by Step
The observation period is the real constraint on timeline — nothing shortens six to twelve months of controls actually operating.
Choosing an Auditor
Only a licensed CPA firm can issue a SOC 2 report — verify licensing directly, and evaluate for SaaS/tech experience, not just price.
Technical Deep Dive: Building the Control Environment
Evidence has to exist for the entire observation period, generated as controls run — not reconstructed retroactively before fieldwork.
The SOC 2 Compliance Maturity Model
Attempting Type II before controls are genuinely operating consistently is the single most expensive, avoidable mistake — an honest maturity assessment prevents it.
Bridge Letters and Continuous Compliance
A bridge letter covers the gap between your last report's end date and your next one — a real, standard tool, not a sign something is wrong.
Framework Mapping
A control implemented once can generally satisfy the equivalent SOC 2, ISO 27001, and NIST CSF control with the same underlying evidence.
Common Mistakes
Nearly every disappointing first SOC 2 report traces back to one of these avoidable mistakes.
Action Checklists
Frequently Asked Questions
Consequences of Control Gaps
SOC 2 has no government fine schedule — the real consequence is competitive and reputational, showing up directly in the report every buyer who reads it sees.
References
AICPA — 2017 Trust Services Criteria (with revised points of focus, 2022), TSC, Common Criteria CC1–CC9
AICPA — SOC suite of services (SSAE No. 18 attestation standards), AT-C 105, 205
AICPA & CIMA — SOC 2 overview, Report structure and auditor requirements
ISO/IEC 27001:2022, Annex A
NIST Cybersecurity Framework 2.0, Govern, Identify, Protect, Detect, Respond, Recover functions
Explore SOC 2
Hub overview →