Compliance guide · Global standard

SOC 2, without the mystery.

If you sell software to US companies, sooner or later a buyer asks for your SOC 2 report. Here is what it is, the difference between Type I and Type II, and how Indian SaaS and AI companies get there.

Get a SOC 2 readiness quote Type I or Type II?
Readiness before the CPA auditEvidence collection set up onceAI controls included
In plain words

SOC 2 is an independent auditor’s report, not a certificate, on how a service company protects customer data. A licensed CPA firm tests your controls against the AICPA’s Trust Services Criteria: Security is always included, and Availability, Processing Integrity, Confidentiality and Privacy are added if relevant. A Type I report looks at your controls on one date; a Type II report tests that they worked over a period, usually 3 to 12 months.

Checked against official sources on . General information, not legal advice.

Issued by
Licensed CPA firms
Criteria
AICPA Trust Services
Type II window
Usually 3–12 months
Typical readiness
6–12 weeks
The two big choices

Which criteria, which type.

Every SOC 2 report covers Security. You choose which other criteria to add, and whether the auditor looks at one date or a whole period.

Left: the five Trust Services Criteria of SOC 2. Security is always in scope; availability, processing integrity, confidentiality and privacy are added if customers need them. Right: a Type I report checks that controls are designed well on one date; a Type II report checks, by sampling evidence, that they worked over a period of 3 to 12 months. AVAILABILITYPROCESSINGINTEGRITYCONFIDENTIALITYPRIVACYSECURITYALWAYS INSCOPEAMBER: ADD IF CUSTOMERS NEED ITTYPE IAre the controls designed well, on one date? ONE DATE TYPE IIDid they work, every time, over months? 3 TO 12 MONTHS OBSERVEDEACH DOT: EVIDENCE THE AUDITOR SAMPLES
SOC 2 reports follow the AICPA’s Trust Services Criteria. Most buyers want Type II; many companies start with Type I to unblock early deals while the observation window runs.
Type I or Type II

Start fast, then prove it over time.

Type I

A snapshot on one date.

  • Faster: no observation window to wait for
  • Unblocks early deals and questionnaires
  • Does not show controls work over time
  • Many buyers ask for Type II at renewal

Type II

Evidence across 3–12 months.

  • Shows controls worked every time they should
  • What most enterprise buyers expect
  • Renewed each year to stay current
  • Takes longer: the window has to pass first
What auditors look at

The nine common criteria.

The Security criteria are split into nine areas, CC1 to CC9. They are where most of the readiness work happens.

  • CC1 · Control environment

    Leadership, ethics, clear roles and background checks.

  • CC2 · Communication

    Policies people know about, and ways to report concerns.

  • CC3 · Risk assessment

    Regular risk reviews, including fraud and big changes.

  • CC4 · Monitoring

    Checking that controls keep working, and fixing those that do not.

  • CC5 · Control activities

    The policies and procedures that put controls into practice.

  • CC6 · Access

    Logins, MFA, access reviews, encryption and physical access.

  • CC7 · System operations

    Finding and responding to vulnerabilities and incidents.

  • CC8 · Change management

    Changes approved, tested and tracked before release.

  • CC9 · Risk mitigation

    Vendors and business disruption: who you depend on, and your plan B.

How we get you ready

Ready before the auditor arrives.

  1. Week 1

    Scope

    Which product, systems and criteria are in scope, and Type I or Type II first.

  2. Weeks 1–3

    Gap check

    Every relevant criterion checked against how you really work today.

  3. Weeks 3–8

    Fix and automate

    Close gaps in access, logging, change control and vendors, and set up evidence collection once.

  4. Weeks 8–10

    Mock audit

    We test samples the way a CPA firm will, so there are no surprises.

  5. CPA firm

    Audit

    Type I on a chosen date, or Type II after the observation window. We support you throughout.

Questions

SOC 2 questions, answered.

Q01Is SOC 2 a certification?
No. It is an attestation report: a licensed CPA firm gives its opinion on your controls. People often say “SOC 2 certified”, but there is no certificate, and the report is shared under NDA with customers.
Q02Who can issue a SOC 2 report?
Only licensed CPA firms. We prepare you, set up your controls and evidence, and support you during the audit, but we do not issue the report.
Q03Should we start with Type I or Type II?
If a deal is waiting, start with Type I to show your controls are designed well, then move to Type II. If you have time, going straight to Type II saves one audit.
Q04Do Indian companies need SOC 2?
If you sell software or services to US companies, very often yes. Indian SaaS, IT services and AI companies get it to pass vendor security reviews faster.
Q05Does SOC 2 cover our AI features?
If AI is part of the service in scope, yes: auditors look at access to models and data, vendor risk for model providers, change control for prompts and models, and how you handle incidents. For AI governance on its own, ISO 42001 is the better fit.
Q06How does SOC 2 relate to ISO 27001?
They overlap heavily. ISO 27001 is a certificate recognised worldwide, while SOC 2 is the report US buyers often prefer. One set of controls can serve both.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings