SOC 2 Audit
Under SSAE 18
Security · Availability · Processing Integrity · Confidentiality · Privacy
A SOC 2 audit evaluates a service organization's controls against the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Our SOC 2 report shows that your company protects customer data, strengthening trust and opening new business opportunities.
SOC 2 Type I vs SOC 2 Type II
Understanding the difference lets you choose the right assessment based on the maturity of your controls and the demands of your clients, investors, and external auditors.
| Criterion | SOC 2 Type IDesign | SOC 2 Type IIEffectiveness |
|---|---|---|
| Primary focus | Evaluates whether the security, availability, confidentiality, integrity, and privacy controls are adequately designed and implemented. | Evaluates the design and verifies the operating effectiveness of the controls over a defined period. |
| Period covered | Performed as of a specific date to validate the implementation of the controls. | Covers a continuous period, usually between 3 and 12 months of operation. |
| Type of evidence | Demonstrates that the controls exist and are designed to meet the applicable Trust Services Criteria. | Provides evidence, through sampling, that the controls operated consistently throughout the period. |
| Ideal use case | Organizations starting their compliance program or that need to quickly demonstrate the existence of controls. | Organizations with mature controls that need to evidence continuous operation to clients, investors, or strategic partners. |
| Estimated time | 1 to 1.5 months from kickoff to report issuance. | Observation period + 1.5 to 2.5 months of execution and issuance. |
| Demand level | Entry point — useful to show that the controls exist and are implemented. | The most requested★ Most popular by corporate clients, investors, and auditors. |
Note: both reports are issued under SSAE 18 and evaluate the AICPA's Trust Services Criteria. The difference lies in whether they assess only the design of the controls or also their operation over time. The times shown are estimates subject to the scope of each engagement.
What kinds of companies need a SOC 2 report?
Organizations that store, process, or transmit sensitive client information are the primary candidates for a SOC 2 audit under SSAE 18.
| Company type | Service offered | How it handles sensitive information | Why it needs SOC 2 |
|---|---|---|---|
| SaaS companies | Software-as-a-service and cloud platforms | Store and process client data in digital environments | Demonstrate adequate controls to protect information and manage risk. |
| Cloud providers | Infrastructure, storage, and cloud services | Manage critical systems and data for multiple clients | Build trust by evidencing the security and availability of their services. |
| Fintech companies | Digital payments, lending, and financial services | Process financial information and sensitive personal data | Demonstrate strong controls to protect information and meet regulatory expectations. |
| AI companies | Artificial-intelligence-based solutions | Use large volumes of data to train and run models | Attest to secure data management, processing, and protection practices. |
| MSPs | Infrastructure management and IT support | Have privileged access to clients' systems and environments | Validate that effective controls exist to manage access and critical operations. |
| Data centers | Hosting and operation of technology infrastructure | Safeguard systems and data essential to third-party operations | Demonstrate physical and logical security controls. |
| HealthTech | Technology applied to the healthcare sector | Manage medical information and sensitive personal data | Strengthen the trust of patients, clients, and regulators. |
| E-commerce | Online sales and digital marketplaces | Process user data, payments, and transactions | Demonstrate that they properly protect customer information and operations. |
| Data processing | Data analysis, storage, and management | Continuously handle critical third-party data | Attest to security, confidentiality, and availability controls. |
| Tech startups | Development of digital products and services | Manage client information and third-party integrations | Ease sales processes and the security requirements demanded by enterprise clients. |
Everything about the SOC 2 report (SSAE 18)
The most common questions from those receiving a SOC 2 report request for the first time. Tap each question to see the answer.
What is a SOC 2 report?
A SOC 2 report is an attestation report issued by a CPA firm under the AICPA's SSAE 18 standard, based on the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
Unlike SOC 1 (focused on financial information), SOC 2 evaluates how your organization protects its clients' data and systems. It's the report most security and procurement teams now ask for by default before signing a contract with a SaaS or technology vendor.
SSAE 18 · Trust Services CriteriaIs SOC 2 a certification?
No. SOC 2 is not a certification or a seal granted by a certifying body. It's an attestation report in which an independent CPA auditor issues a professional opinion on your controls.
Why the precision matters: unlike ISO 27001 (which is a certification), the correct phrasing is "obtain a SOC 2 report," not "get SOC 2 certified." No provider can "certify" you in SOC 2.
What are the Trust Services Criteria?
They are the five criteria defined by the AICPA that a SOC 2 report can evaluate:
- Security (mandatory in every SOC 2)
- Availability — the system is operational when needed
- Processing integrity — processing is complete, valid, and timely
- Confidentiality — information designated as confidential is protected
- Privacy — the handling of personal data follows the stated principles
Only Security is mandatory; the others are added based on what your organization needs to demonstrate.
How does SOC 2 differ from ISO 27001?
ISO 27001 is an international certification of an information security management system (ISMS), issued by a certifying body.
SOC 2 is an attestation report issued by a CPA firm, with a detailed opinion on specific controls over a period of time. They're not mutually exclusive: many companies hold both, since different clients and markets ask for one or the other.
What is a SOC 2 report for? What are its benefits?
A SOC 2 report lets you:
- Accelerate the sales cycle by answering your prospects' security questionnaire up front
- Meet the procurement requirements of enterprise and Fortune 500 clients
- Build trust with clients, investors, and partners
- Reduce the risk of security incidents and data breaches
- Stand out from competitors that don't have it yet
For many SaaS companies, SOC 2 is no longer optional: it's the entry requirement to sell to mid-market and large enterprises in the U.S.
What is the difference between SOC 2 Type I and Type II?
| Criterion | SOC 2 Type I (design) | SOC 2 Type II (effectiveness) |
|---|---|---|
| Primary focus | Evaluates whether the controls are adequately designed and implemented | Evaluates the design and verifies operating effectiveness over time |
| Time dimension | Performed as of a specific date | Covers a continuous period, usually 3 to 12 months |
| Ideal use case | Organizations starting their compliance program | Organizations with mature controls that need to demonstrate continuous operation |
Type II is the most requested by enterprise clients, investors, and security teams.
Should I go with a SOC 2 Type I or a Type II?
It depends on your urgency and what your client requires:
- Type I is useful if you need to show quick progress — for example, if a large prospect asks for "something" before signing and you can't wait months.
- Type II is the real standard for serious procurement processes and for investors.
Many startups get a Type I first to accelerate a specific sale, then move to Type II in the next cycle.
How does SOC 2 differ from SOC 1?
SOC 1 evaluates controls that impact your clients' financial information (ICFR). SOC 2 evaluates the Trust Services Criteria: security, availability, integrity, confidentiality, and privacy.
- If your service affects financial statements → SOC 1
- If your service manages data and the concern is security → SOC 2
- A financial SaaS (e.g., payroll or billing) usually needs both
How does SOC 2 differ from SOC 3?
SOC 3 is based on the same audit as SOC 2, but it's a public, summarized version without the confidential technical detail. The full SOC 2 is shared under NDA with clients; SOC 3 can be published freely on your website.
What kinds of companies need a SOC 2 report?
It's common in:
- SaaS companies and cloud platforms
- Cloud infrastructure and hosting providers
- Fintechs and payment processors
- Cybersecurity companies
- Data centers
- HealthTech (with the Privacy criterion)
- Any organization that stores or processes client data in its own systems
How do I know if my company needs a SOC 2?
If you answer yes to any of these questions, you should consider it:
- Do your prospects send you security questionnaires before buying?
- Do you store or process client data in your own systems?
- Do your enterprise clients ask you for a SOC 2 as a procurement requirement?
- Are you competing for contracts where the competition already has SOC 2?
Which Trust Services criteria should I include in my SOC 2?
Security is always mandatory. The others depend on your business:
- Availability — if your clients depend on the continuous operation of your service (uptime SLA)
- Confidentiality — if you handle sensitive contractual or commercial information
- Privacy — if you process end users' personal data (PII)
- Processing integrity — if your service calculates or transforms critical data (e.g., payments)
We define the scope with you before starting, so we don't audit criteria your client isn't asking for.
How long does a SOC 2 audit take?
- SOC 2 Type I: fieldwork and issuance usually take between 1 and 1.5 months from kickoff.
- SOC 2 Type II: first requires an observation period of 3 to 12 months, plus an additional 1.5 to 2.5 months for execution and issuance.
Reports are valid for one year.
Managing expectations: if you need a Type II "for next month" and you don't have any observation period yet, it isn't possible — the realistic path is a Type I now.
What evidence is requested in a SOC 2 audit?
It depends on the criteria in scope, but typically:
- Security policies and procedures
- Evidence of access management and change control
- Monitoring and incident logs
- Encryption and backup configurations
- Business continuity controls
- For Type II: samples of control operation throughout the entire period
Do I need to prepare before a SOC 2 audit?
If you don't yet have documented policies or technical controls operating consistently (MFA, access management, monitoring), a prior readiness process is advisable.
Independence: AICPA standards do not allow the same firm that helps you implement controls to then be the one that audits you. We guide you, but that work is done by an independent third party.
What happens if deviations are found in the controls?
A SOC 2 is not a pass/fail exam. Deviations are documented along with management's response, and their impact is evaluated in the final opinion. A transparent report with explained deviations usually builds more trust than one that appears flawless.
How often should a SOC 2 report be renewed?
SOC 2 reports are valid for one year. Most enterprise clients and procurement teams require a report less than 12 months old to keep relying on it.
Is SOC 2 recognized outside the United States?
Yes. SOC 2 under SSAE 18 is widely recognized in the U.S. and internationally. Its content is substantially equivalent to the IAASB's ISAE 3000, so we can issue dual-use SOC 2 + ISAE 3000 reports for clients with international requirements.
Equivalent to ISAE 3000 (IAASB)Do you offer SOC 2 audits in Latin America?
Yes. We work with technology companies in the United States, Colombia, Mexico, Chile, Peru, Argentina, Panama, Costa Rica, Ecuador, and more countries. We serve clients in English and Spanish, which makes the process easier for your local team and for auditors/clients in the U.S.
Who can issue a valid SOC 2 report?
Only a registered CPA firm with an active license from a State Board of Accountancy can issue a valid SOC 2 report under SSAE 18. Next Assurance meets all these requirements and has coverage in the U.S. and across Latin America.
Can I share my SOC 2 publicly? Not directly — the full report is distributed under NDA. If you want to show your compliance on your website without restrictions, the option is to complement it with a SOC 3.
How much does it cost? There's no single fee: it depends on the scope (selected criteria), the size of the system evaluated, and whether it's Type I or Type II. We define the scope with you before quoting.
Did a client ask you for a SOC report?
Choose the option that best describes your situation — we'll take you straight to what you need.