FAQ Category: FAQs • SOC 2

The Availability criteria address whether information and systems are available for use as needed to meet the service commitments and system requirements in scope. Practical work includes capacity planning, monitoring, recovery arrangements, and recovery testing. The examples below should be tailored to those commitments; they are not a universal checklist of required technologies.

SOC 2 cost depends on the system scope, report type, reporting period, and work needed before the examination. Budget separately for the CPA firm’s fee, any readiness advice, optional software, remediation, and internal staff time. Ask providers to quote the same scope and state exclusions. A reliable estimate needs those details; a single price range can hide very different projects.

The five SOC 2 categories are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Not every SOC 2 report covers all five categories. Read the report to see which categories and criteria were included in its scope.

To obtain a SOC 2 report, agree the system scope, categories, and report type with an independent CPA firm. Identify gaps, put the controls into practice, and collect the evidence needed for the examination. For Type 2, that includes evidence of controls operating over the agreed period. The CPA firm examines the system description and controls, then issues its report. Readiness work helps you prepare but is not the examination itself. The result is a report, not a general SOC 2 certification.

The timing depends on customer and contractual requirements, not a universal certificate expiry date. Ask customers what report age and coverage period they accept, and check contractual requirements. Then agree the next examination with your auditor, allowing time to address gaps and avoid unwanted breaks in coverage. A Type 1 report addresses a date; a Type 2 report covers a period. Completing Type 1 does not by itself set a deadline for Type 2.

SOC 1 asks whether a service organization’s controls support reliable financial reporting by its customers. For example, a payroll provider’s processing can affect a customer’s payroll expense figures. SOC 2 asks about controls over the service system, such as protecting data or meeting availability commitments, within the categories examined. A hosted application may therefore be asked for SOC 2 even when it does not feed financial statements. The same provider can need both: the deciding factor is the customer’s assurance question, not the provider’s industry label.

Map three roles: who runs controls, who oversees management, and who independently evaluates the results. Mark where the same person fills more than one role. For example, a suitably independent director or adviser might challenge management’s risk decisions, while a separate reviewer checks control evidence without reviewing their own work. Record responsibilities, conflicts, and escalation routes. These arrangements need to fit the company; reciprocal board seats alone do not establish independence. Discuss the control design with your auditor and obtain governance or legal advice before changing board or internal audit arrangements.