At a glance
Free tool
Want a quick read on where you stand? Take the free 5-minute SOC 2 readiness checklist before your scoping call.
Open the SOC 2 checklist →Who needs it
Any US-based B2B SaaS or cloud service provider selling to mid-market or enterprise buyers. There is no legal requirement; procurement teams ask for it during vendor due diligence.
The five criteria
Only Security is required. You add the others based on what you sell.
| ID | Requirement | What it means in practice |
|---|---|---|
| CC | Security | Access control, change management, monitoring, and incident response. Required for every SOC 2 engagement. |
| A | Availability | Add if you commit to uptime SLAs or your customers depend on the system being up. |
| PI | Processing Integrity | Add if correctness of calculations or transactions is a core product promise (fintech, billing, etc.). |
| C | Confidentiality | Add if you handle contractually confidential data distinct from personal data. |
| P | Privacy | Usually handled under GDPR or CCPA instead. Not common in SOC 2 scopes. |
Type I vs Type II
| Type I | Type II | |
|---|---|---|
| Tests | Whether controls are designed properly | Whether they actually work over time |
| Window | Point in time | Minimum 3 months (usually 6 or 12) |
| Timeline | 6–8 weeks | Observation + 4–6 weeks audit |
| Buyer view | Accepted temporarily | The standard they actually want |
What people get wrong
“SOC 2 is a certification.”
It is an attestation report. No certificate exists, no official logo or badge is sanctioned by the AICPA.
“A platform can get us SOC 2 ready in two weeks.”
Tools speed up evidence collection. They cannot compress the 3-month observation window or issue the CPA opinion.
“Template policies pass audits.”
Sometimes. More often they get flagged when the auditor's tests don't match how your team actually operates.
Related frameworks
| Framework | Relationship | Practical impact |
|---|---|---|
| ISO 27001 | 60–70% policy overlap | The international complement. Most companies pursuing both run one integrated program. |
| HIPAA | Large technical overlap | SOC 2 Security covers most HIPAA Security Rule technical safeguards. Privacy Rule is HIPAA-only. |
| PCI-DSS | Separate | Required by card networks, not law. Shares baseline controls but tests differently. |
| ISO 42001 | Adjacent | AI governance layer for AI-native companies. Sits alongside SOC 2, doesn't replace it. |