Security · Attestation report
SOC 2, the attestation report for service organisations
The attestation report US clients often ask service providers for.
- Type
- Attestation report
- Group
- Security
- We help with
- ISO 27001 and GRC
- Issued by
- Licensed CPA firm
What it is.
SOC 2 is an AICPA attestation that reports on a service organisation's controls against the Trust Services Criteria. The report is issued by a licensed CPA firm after an examination.
SOC 2 reports are issued by licensed CPA firms; we prepare you for the examination.
Who usually needs it
- SaaS and IT services firms with US clients
- Service providers asked for a SOC 2 report in procurement
- Firms already running ISO/IEC 27001 who need a US-recognised report
Related founder credential
CISM: Certified Information Security ManagerHeldWhat it covers.
- 01
Trust Services Criteria
Security, availability, processing integrity, confidentiality and privacy.
- 02
Type I
Covers the design of controls at a point in time.
- 03
Type II
Covers the operating effectiveness of controls over a period.
How we help with SOC 2
We help you choose the Trust Services Criteria in scope, map them to your existing controls and close the gaps before a Type 1 report or the observation period of a Type 2. Evidence collection is set up so it runs during the period, not in a rush at the end. The examination and report come from a licensed CPA firm; we prepare you for it.
Typical phases.
Each phase ends with something you keep. Timelines depend on scope and are agreed in the proposal.
- 1
Readiness
- Scope and criteria
- Gap report
- 2
Remediate
- Controls and policies
- Evidence trail
- 3
Type I
- Design-ready controls
- 4
Type II period
- Operating evidence
- Examination support
A licensed CPA firm. SOC 2 reports are issued by licensed CPA firms; we prepare you for the examination.
Type I covers the design of controls at a point in time; Type II covers operating effectiveness over a period. Many firms start with Type I.
Often, yes. The controls overlap, so much of the evidence can serve both.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal
This page is general guidance, not legal advice. Last reviewed October 2026.