AutomateWisely Editorial Team · Last reviewed October 31, 2026 · How we research
Most companies meet SOC 2 the same way: a deal is moving, and then a message like this arrives from the customer’s security team.
So what are they asking for? A SOC 2 report is an independent auditor’s opinion on whether a service company’s controls protect the customer data it handles. It is not a law, not a certificate and not a checklist you can download. It is a report, issued under standards set by the AICPA, the American Institute of Certified Public Accountants.
Choose what your report covers
The criteria come from the AICPA’s 2017 Trust Services Criteria with revised points of focus (2022), still the current version in October 2026. Security, called the Common Criteria, applies to every report. The other four categories are optional and add criteria on top. Tap them to see how scope grows.
Criteria counts from the 2017 Trust Services Criteria (revised points of focus, 2022) as summarized by the SOC 2 Auditors Directory. More criteria usually means more testing and a higher audit fee.
The nine families inside Security
The Common Criteria are grouped into nine series. Here is what each looks like in an ordinary software company, and the kind of evidence an auditor asks for.
Examples are typical, not mandatory. You design your own controls; the auditor checks they meet the criteria.
SOC 2 vs SOC 1 vs SOC 3
| SOC 1 | SOC 2 | SOC 3 | |
|---|---|---|---|
| Focus | Controls relevant to customers’ financial reporting | Security and the other Trust Services categories | Same criteria as SOC 2 |
| Typical reader | Customers’ finance teams and their auditors | Customers’ security and procurement teams | Anyone: a public summary |
| Detail | Full report with tests | Full report with tests, shared under NDA | Short report without test details |
| Who needs it | Payroll, billing, financial services providers | SaaS, cloud, data and IT service providers | Companies that want a public trust signal |
Based on the AICPA’s descriptions of its SOC reports.
Type 1 or Type 2?
Type 1: a snapshot
Are the controls suitably designed on a specific date? Faster and cheaper, useful when a deal needs something now.
Type 2: a film
Were they designed well and did they operate effectively over a period agreed with the auditor? This is what most enterprise buyers ask for.
The AICPA sets no universal minimum for the period. The trade offs, including timing and fees, are in SOC 2 Type 1 vs Type 2.
What is inside the report
When a vendor sends you their report, or you receive your own, these are the parts. Tap through them.
How companies get there
Budget is the question everyone asks next. Audit fees for small companies can start around $7,000 for a Type 2, but the full first year is several times that once software, testing and staff time are included. See the full breakdown in SOC 2 compliance cost.
Short answers
Is SOC 2 mandatory?
No law requires it. Customers do, through contracts and vendor reviews.
Does it apply outside the US?
Yes. It is an American standard, but buyers worldwide accept it, especially in software.
How long is a report valid?
It has no formal expiry. In practice buyers want one covering a recent period, so most companies renew every year.
SOC 2 or ISO 27001?
US buyers lean to SOC 2, many European and global buyers to ISO 27001. Controls overlap heavily, so evidence can be reused.
Can we do it without software?
Yes. Platforms save evidence collection time but are optional. Compare options in best SOC 2 compliance software.
Are the criteria changing?
The AICPA released a proposed update in October 2026. It is an exposure draft, not final; the 2017 criteria with 2022 points of focus remain current.
Where to go from here
Sources
- AICPA, SOC 2 overview
- SOC 2 Auditors Directory, SOC 2 Trust Services Criteria (updated October 26, 2026)
- SOC 2 Auditors Directory, SOC 2 requirements: what is mandatory and what is optional (updated October 8, 2026)
General information, not audit or legal advice. Spotted an error? Tell us.