SOC 2 Compliance: A Practical Guide for Growing Companies

SOC 2 reports help a service organization communicate information about controls relevant to the services it provides. Customers may request a report as part of vendor due diligence, but SOC 2 is not a universal legal requirement for every organization handling customer data, and it is a report, not a certification.

In brief: Type I addresses a system description and the suitability of control design at a point in time. Type II also addresses operating effectiveness over a specified period. An independent CPA firm performs the examination; readiness work and ongoing operations remain the organization's responsibility. See the AICPA SOC resources.

What is included in SOC 2?

A SOC 2 examination uses applicable Trust Services Criteria: security and, depending on scope, availability, processing integrity, confidentiality, and privacy. The scope should reflect the service, system boundaries, customer commitments, and users' needs. Discuss the criteria, report distribution, and period with the CPA firm and prospective customers.

Type I versus Type II

A Type I report covers the description of the system and the suitability of the design of controls at a particular date. A Type II report also covers whether controls operated effectively over a specified period. A Type I report is not a mandatory prerequisite for Type II. The observation period, readiness time, and examination schedule depend on the organization and the auditor's engagement.

How do we prepare?

1. Define the service, system boundary, and applicable criteria.
2. Assign owners for access management, change control, monitoring, incident response, backups, and vendor management.
3. Identify gaps between documented controls and actual practice, then remediate them.
4. Collect evidence consistently throughout the relevant period.
5. Discuss the scope and timing with an independent CPA firm and confirm what customers expect.

Costs vary with scope, readiness, service providers, and the CPA firm. Ask for separate quotes for readiness work, tooling, and the examination instead of relying on a fixed industry price.

How can an MSP help?

An MSP or MSSP can support technical controls and evidence collection within its agreed scope. The service organization retains responsibility for its own controls, and an independent CPA firm performs the examination. AdVran's SOC 2 readiness support can help with planning and documentation.

Is a report renewed annually?

A Type II report covers a defined period. Many customers ask for a current report on a recurring basis, often annually, but the necessary cadence depends on customer expectations and the engagement. It is more accurate to discuss a new examination than recertification.

Related reading

• Compliance and risk management
• Zero trust architecture
• 24/7 SOC monitoring