FAQ: How does a company get SOC 2 certified?

To obtain a SOC 2 report, agree the system scope, categories, and report type with an independent CPA firm. Identify gaps, put the controls into practice, and collect the evidence needed for the examination. For Type 2, that includes evidence of controls operating over the agreed period. The CPA firm examines the system description and controls, then issues its report. Readiness work helps you prepare but is not the examination itself. The result is a report, not a general SOC 2 certification.

Additional FAQs

How should we organize SOC 2 evidence folders?

Choose a structure the whole team can explain, such as reporting period, control identifier, and activity date. Keep an index linking each requested item to its location and owner. Separate

Should we ask vendors how they manage their own third parties?

Yes, especially when the service supports important operations or gives others access to sensitive information. Ask how the vendor: For an important dependency, request a recent review example and its

What should we monitor after an AI feature goes live?

Monitor the outcomes that matter for the approved use, not just whether the service is online. Consider error reports, unexpected actions, review overrides, complaints, and meaningful changes in output quality.

What is fourth-party risk?

Fourth-party risk is the risk to your organization from a supplier your vendor relies on. For example, your payroll provider may use a separate hosting company. An outage or security

What are the costs of SOC 2?

SOC 2 cost depends on the system scope, report type, reporting period, and work needed before the examination. Budget separately for the CPA firm’s fee, any readiness advice, optional software,

Should we wait for the proposed SOC 2 updates before improving AI controls?

No. Begin with the AI uses and risks you already have. Identify owners, document data flows, review access, define appropriate human oversight, and retain records of important decisions and evaluations.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide