The short answer
SOC 2 is an attestation report, not a certificate, issued by an independent licensed CPA firm after examining your controls against the AICPA Trust Services Criteria. To get one, define your scope, choose your criteria (Security is always included), run a gap assessment, fix gaps and implement controls, engage a CPA firm, optionally complete a Type 1 report, run an observation period for a Type 2 report while collecting evidence, and complete audit fieldwork. You then receive the report with the auditor's opinion, share it under NDA and renew it each year. A consultant prepares you but cannot issue the report.
The SOC 2 Journey at a Glance
SOC 2 reports are based on the Trust Services Criteria from the American Institute of CPAs (AICPA). If you are comparing it with ISO 27001, read our guide on SOC 2 vs ISO 27001.
| Phase | What happens | Who leads |
|---|---|---|
| Scope and criteria | Decide systems and Trust Services Criteria | You, with a consultant if used |
| Gap assessment | Compare controls with the criteria | You, with a consultant |
| Remediation | Write policies, set up controls, fix gaps | You, with a consultant |
| Auditor engagement | Agree scope, period and evidence | You and the CPA firm |
| Type 1 (optional) | Auditor checks design at a point in time | CPA firm |
| Observation period | Controls run, evidence is collected | You |
| Fieldwork and report | Auditor tests controls and issues the report | CPA firm |
| Renewal | New period and a fresh report each year | You and the CPA firm |
| Party | Role | Issues the report? |
|---|---|---|
| Management | Owns the system, controls and written assertion | No |
| Consultant (for example Impleton) | Prepares you, designs controls and coordinates with the auditor | No |
| Independent licensed CPA firm | Examines controls and issues the SOC 2 report | Yes |
| Compliance automation vendor (optional) | Software to track controls and collect evidence | No |
The 10 Steps to Get SOC 2
1. Understand SOC 2 and what your customers need
Confirm that a customer or prospect has asked for SOC 2, and whether they expect a Type 1 or a Type 2 report. Note that SOC 2 is an attestation report, not a certificate.
2. Define the scope
Decide which products, services, infrastructure, software, people, data and vendors fall in the system that will be examined.
3. Select the Trust Services Criteria
Security is always included. Add Availability, Confidentiality, Processing Integrity or Privacy only if your customers need them or your service promises them.
4. Run a gap assessment
Compare your current controls with the criteria you chose, so you see which controls exist, which need improving and which are missing.
5. Remediate and implement controls
Write policies, set up access control, logging, change management, vendor management, incident response and backup, and fix the gaps the assessment found.
6. Choose tools and an auditor
Decide whether to use a compliance automation platform, and engage an independent licensed CPA firm early so scope, period and evidence expectations are agreed.
7. Consider a Type 1 report first
An optional Type 1 report confirms your controls are suitably designed at a point in time, and can give customers an early answer.
8. Run the observation period
For Type 2, your controls operate over a period while you collect evidence such as access reviews, change tickets, scan results and training records.
9. Complete audit fieldwork
The auditor tests your controls, samples evidence, interviews staff and reviews your system description and management assertion.
10. Receive the report and keep it current
You receive the SOC 2 report with the auditor's opinion. Share it under NDA, and plan a fresh report each year.
Want help with every step?
Book a free consultation. We assess your scope and current controls, give you a realistic timeline and a fixed-fee quote for our readiness support, with no obligation.
The Trust Services Criteria
You choose which criteria to include. Security is always included, and the others are optional.
| Criteria | What it covers | When to include it |
|---|---|---|
| Security | Protection against unauthorised access (always included) | Always |
| Availability | System is available as committed | You promise uptime or SLAs |
| Confidentiality | Confidential information is protected | You hold sensitive customer data |
| Processing Integrity | Processing is complete, accurate and timely | Accuracy of processing is central to your service |
| Privacy | Personal information is handled as committed | You process personal information and customers expect it examined |
What the Security criteria cover
The Security criteria, also called the common criteria, are organised into groups. Auditors test your controls across all of them.
| Criteria group | Topic | Typical controls |
|---|---|---|
| CC1 | Control environment | Code of conduct, roles, board or management oversight, hiring checks |
| CC2 | Communication and information | Policies shared with staff, customer commitments, security communications |
| CC3 | Risk assessment | Documented risk assessment, fraud and change risk considered |
| CC4 | Monitoring activities | Ongoing monitoring, internal reviews, deficiency tracking |
| CC5 | Control activities | Policies and procedures that put controls in place |
| CC6 | Logical and physical access | Access reviews, MFA, encryption, onboarding and offboarding, office security |
| CC7 | System operations | Logging and monitoring, vulnerability management, incident response |
| CC8 | Change management | Approved, tested changes with separation of duties |
| CC9 | Risk mitigation | Vendor management, business disruption and insurance considerations |
Evidence Auditors Ask For
For a Type 2 report, the auditor samples evidence across the observation period. Collecting it routinely from day one is the best way to avoid delays.
| Area | Evidence examples |
|---|---|
| Access control | User lists, access review records, onboarding and offboarding tickets, MFA settings |
| Change management | Change tickets with approvals, code review records, deployment logs |
| Vulnerability management | Scan results, remediation tickets, penetration test report |
| Incident response | Incident register, post-incident reviews, test of the response plan |
| Backup and recovery | Backup logs, restore test results, disaster recovery test |
| HR and training | Background check records, policy acknowledgements, security training completion |
| Vendor management | Vendor inventory, assessments, contracts and SOC reports from key vendors |
| Governance | Risk assessment, policies, management meeting minutes, internal review records |
How Long It Takes and What It Costs
Time depends on your size, scope and current controls. Readiness and remediation come first, then an observation period for a Type 2 report, which is commonly several months and is accepted at the auditor's discretion, then fieldwork and report writing. Cost has several parts: readiness and consulting, tooling, a penetration test, the auditor's fee and your staff time. See our SOC 2 Type 2 cost guide, which includes a calculator.
Choosing Your Auditor and Support
- The auditor must be an independent licensed CPA firm. Ask about its SOC 2 experience in your industry and about the people who will do the work.
- Engage the auditor early, so scope, observation period and evidence expectations are agreed before you start collecting evidence.
- Ask for written quotes covering year one and the renewal.
- Choose a consultant for readiness who explains clearly that the report is issued only by the auditor.
- Decide whether a compliance automation platform will save more staff time than it costs.
Keeping the Report Current
Customers usually expect a fresh report each year. Keep evidence collection routine, review access and vendors regularly, record changes and incidents as they happen, and review your scope when your product changes. If there is a gap between periods, your auditor may be able to provide a bridge letter, depending on circumstances.
Common Myths
| Myth | Reality |
|---|---|
| SOC 2 is a certificate | It is an attestation report from a CPA firm |
| You can get SOC 2 in a few days | Type 2 needs controls to operate over a period before the auditor can report |
| A consultant can issue the report | Only an independent licensed CPA firm can |
| A tool makes you compliant | Tools help collect evidence, but your people and processes must run the controls |
| SOC 2 means you cannot be breached | It examines controls, it does not guarantee that no incident will occur |
SOC 2 Readiness Support in Chennai
Impleton helps SaaS, IT, BPO, fintech and healthcare companies across Chennai and India prepare for SOC 2. We offer a free consultation, gap assessment, control design, policies, staff training and coordination with the independent auditor, with a fixed-fee quote for our consulting. We do not issue SOC 2 reports; those come from an independent licensed CPA firm. We support businesses in and around:
See our SOC 2 page, our ISO 27001 certification in Chennai page, or talk to our team.