What SOC 2 is
SOC 2 is an attestation report issued by an independent CPA firm against the AICPA's Trust Services Criteria. Security (the common criteria) is always in scope. Availability, Confidentiality, Processing Integrity and Privacy are added when customers need them.
There is no SOC 2 certificate and no pass mark. The auditor gives an opinion on your controls and lists any exceptions found in testing. Customers read those exceptions.
Type I or Type II
A Type I report evaluates whether controls are suitably designed at a point in time. A Type II report tests whether they operated effectively over a review period, commonly between three and twelve months. Many buyers ask for Type II. A Type I can unblock deals while the Type II period runs.
Where first audits stall
- Vague scope: the system description doesn't match what you actually run, so the auditor finds systems you forgot.
- Policies that aren't followed: auditors sample evidence that controls ran, not the policy document.
- Access reviews: missing, late, or approved without anyone checking the list.
- Change management: changes that reach production outside the reviewed, ticketed path.
- Offboarding: accounts that outlive employment, especially in SaaS tools outside single sign-on.
- Vendor management: no inventory of vendors that hold customer data and no record of reviewing them.
- Evidence: screenshots collected the week before fieldwork, with no proof they reflect the whole period.
Make evidence a by-product
Pull evidence continuously from systems of record (identity provider, cloud accounts, version control, ticketing) instead of building screenshot folders. Give every control a named owner. Run a readiness assessment, a gap analysis against the criteria, before the review period starts so that fixing gaps doesn't eat into it.
Choosing the auditor
Only a licensed CPA firm can issue the report. Ask about experience with companies of your size and stack, how they sample, which evidence formats they accept from compliance platforms, and how long they take from fieldwork to report. Keep readiness and attestation separate: the firm that helps you build controls should not be the one that audits them.