SOC 2 briefs.

Your enterprise prospect sent a security questionnaire. Or your sales cycle stalled on “do you have a SOC 2 report?” SOC 2 (System and Organization Controls 2) is the audit framework US enterprise buyers use to verify that your security controls are real — not just a policy document sitting in Notion.

It covers five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Most SaaS companies start with security only — the one required criterion — and add others as contracts demand. Type I tests your controls at a point in time. Type II tests whether they operated over a period (usually six or twelve months). The briefs below cover the decisions you face before, during, and after your first audit: how to scope, what auditors actually test, and how to run the programme without halting product work.

If you’re ready to scope a SOC 2 programme, visit the SOC 2 service page or book a scoping call.