SOC 2 Attestation
SOC 2 reports on how a service organisation's controls meet the AICPA Trust Services Criteria for security and related categories.
- Standard
- SOC 2 Type II
- Indicative timeline
- 10-16 weeks to readiness, plus a 3-12 month observation period
- Discipline
- Compliance & Security
- Assessment type
- Independent third-party assessment
The standard
Overview
SOC 2 is an attestation engagement performed against the AICPA Trust Services Criteria. Security, the common criteria, is always included; availability, processing integrity, confidentiality and privacy are added according to the commitments you make to customers. The common criteria run from CC1 to CC9 and follow the COSO framework, covering the control environment, risk assessment, monitoring, logical and physical access, system operations, change management and risk mitigation.
The report tells customers that the controls you describe were in place and operating throughout the period. It is the assurance most often requested in enterprise procurement and vendor risk review. Unlike a certificate, it is a full report: the reader sees the controls, the tests performed and any exceptions.
UKCert runs the readiness work. We map your controls to the criteria in scope, close gaps in monitoring, access management and change control, and set up the evidence collection needed across the observation period. The opinion is issued by an independent, licensed CPA firm.
Who this is for
- SaaS and cloud platform providers
- Companies storing or processing customer data
- Managed service and IT support providers
- Data analytics, AI and hosting businesses
- Suppliers facing enterprise vendor risk reviews
What it gives you
Why organisations certify
What a certified SOC 2 Type II assessment gives you once the certificate is issued.
Clears Vendor Reviews
Enterprise security teams accept a current SOC 2 report in place of long questionnaires, which shortens procurement and removes a common obstacle late in a sales cycle.
Opens US Accounts
North American buyers treat SOC 2 as the default assurance for handling their data. Without a report, many will not take a supplier past initial review.
Access Under Control
Joiner, mover and leaver steps, privileged access review and multi-factor authentication are documented and tested, so access rights match current roles.
Tested Over Time
A Type II report covers months of operation, not a snapshot. It shows controls held up under real conditions, which carries more weight than a point-in-time review.
Incident Readiness
Detection, escalation and response are defined and exercised. When something happens there is a route to follow and a record of what was done.
Supplier Risk Visible
Subservice organisations and vendors are inventoried, assessed and monitored, so dependencies in your supply chain are known rather than discovered during an incident.
Scope
What the assessment covers
The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.
- Trust Services Criteria categories in scope
- Common criteria CC1 to CC9 control mapping
- System description under the description criteria
- Logical and physical access controls
- Change management and system development controls
- Monitoring, logging and incident response
- Vendor and subservice organisation management
- Complementary user entity controls and carve-outs
How it runs
The assessment, stage by stage
From first enquiry to certificate. Each stage is agreed with you before it starts.
-
Scope and Criteria
We agree which Trust Services categories apply, based on the commitments in your customer contracts, and define the system boundary covering people, processes, data and infrastructure.
-
Readiness Assessment
Existing controls are mapped to the criteria in scope. We record where a control is missing, where it exists but produces no evidence, and where policy and practice differ.
-
Remediation
Gaps are closed before the observation period opens: access review, logging and alerting, change approval, risk assessment, vendor management and the policy set the criteria expect.
-
Report Type Decision
You either take a Type I report on control design at a point in time first, or move straight to Type II. We advise on which suits your customer commitments and deadlines.
-
Observation Period
The service auditor tests controls across the agreed window, commonly three to twelve months for a first report. We manage evidence collection so requests arrive in one stream.
-
Report and Annual Cycle
The independent CPA firm issues the report with its opinion and any exceptions. Reports are then produced annually, over consecutive periods, so customers see unbroken coverage.
Questions
SOC 2 Type II — frequently asked
Anything here that does not cover your situation, put it to an assessor rather than guessing at it.
Same discipline
Other schemes in Compliance & Security
Certifying against more than one standard?
Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what SOC 2 Type II should sit alongside.