FAQ: Can we scope SOC 2 to one product rather than the whole company?

Often, yes, provided the scope accurately describes the service and the systems supporting it. Start with the customer-facing product, then trace its data, infrastructure, people, and supporting processes. Shared identity management, HR, support, and deployment systems may still matter even if other products are excluded. Write down the boundary and explain any exclusions to your auditor. Also check whether that boundary answers the customer's actual concern. A narrowly scoped report can be useful, but it should not be marketed as covering unrelated products, business units, or activities that were outside the examination.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview.

Additional FAQs

We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?

Map three roles: who runs controls, who oversees management, and who independently evaluates the results. Mark where the same person fills more than one role. For example, a suitably independent

How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,

What should we ask a compliance software vendor to demonstrate?

Use your own workflow as the demo script. Ask the vendor to collect an example record, show its source and date, assign an owner, record a review, handle an exception,

What should happen when an evidence integration stops working?

Make the failure visible and assign an owner to resolve it. Record the affected systems, the last successful collection, the missing period, and whether the underlying control continued operating. Use

SOC 1 or HITRUST?

Choose based on the assurance your customers need. SOC 1 addresses controls relevant to customers’ internal control over financial reporting. HITRUST offers cybersecurity assessments and certifications with different scopes and

What should we settle before asking for SOC 2 audit quotes?

Start with a short scope brief. Name the service customers use, the legal entity providing it, the systems supporting it, and the report customers expect. Include your target delivery date,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide