attestation
SOC 2
A report from a licensed auditor on your controls, built on US audit standards and asked for in sales questionnaires. No law requires it, and new criteria were proposed in October 2026.
- what it is
- An attestation report by a CPA firm under AICPA standards.
- who it covers
- Service organisations that choose it, usually because a customer asked.
- penalties
- None under law. A qualified opinion or no report can cost you the deal.
- legal weight
- None in EU law. It can support, and cannot replace, your own showing.
- status
- AICPA lists exposure drafts of proposed 2027 criteria, dated 26 October 2026.
basis GDPR Art. 24(1); AICPA and CIMA, SOC suite page
when it comes up
An EU company usually meets SOC 2 in a sales questionnaire. No EU regulation on this site requires it. The first question is what the customer will accept, because the answer may save you the year.
There are five criteria categories: security, availability, processing integrity, confidentiality and privacy. Security is in every report and the others are optional. Which ones you pick changes the size of the work, so pick them with the customer who asked.
basis AICPA criteria as commonly described. Gated, and not re-read at source.
the two types
type I looks at a date, type II looks at a period
- 1start of the period: the controls have to be running from here
- 2one date: were the controls designed properly on this day?
- 3end of the period: did they run throughout? Picture a 12-month period here; the length is agreed with the auditor.
basis AICPA, as commonly described. The criteria are gated and were not re-read at source.
A type II report needs the controls running, with evidence, for the whole period. So the earliest you can have one depends on when your controls started, whatever you are prepared to pay.
basis AICPA as commonly described. Not re-read at source.
do the work first
do the work once, and buy the proof you are asked for
- 1do the control workthe nine rows of the map
- 2keep the evidencedated, owned, filed
the same file feeds
- ISO 27001a certificate for a scope
- SOC 2an auditor's report on a period
- your own answerto a regulator or a customer
basis working practice. No legal text sets this.
The control work is the same either way, as the map shows. The numbers there are the commonly published ones from the 2017 criteria, so have your auditor confirm them and ask how the 2027 proposal affects your period.
basis working practice. No legal text sets this.
check it yourself
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Ask the customer who raised it what they need, then check whether evidence you already hold answers it.