certification
SOC 2
A report from a licensed auditor on your controls, built on US audit standards and asked for in sales questionnaires. No law requires it, and new criteria were proposed in October 2026.
at a glance
- what it is
- An attestation report by a CPA firm under AICPA standards.
- who it covers
- Service organisations that choose it, usually because a customer asked.
- penalties
- None under law. A qualified opinion or no report can cost you the deal.
- legal weight
- None in EU law. It can support, and cannot replace, your own showing.
- status
- AICPA lists exposure drafts of proposed 2027 criteria, dated 26 October 2026.
basis GDPR Art. 24(1); AICPA and CIMA, SOC suite page
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my rulestype I looks at a date, type II looks at a period
- 1start of the period: the controls have to be running from here
- 2one date: were the controls designed properly on this day?
- 3end of the period: did they run throughout? Picture a 12-month period here; the length is agreed with the auditor.
basis AICPA, as commonly described. The criteria are gated and were not re-read at source.
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- decide whether to get a report, and what for
Find out what the customer will accept, which report type and criteria categories you need and which service it covers.
- check where you stand
Compare your controls with the criteria you chose and turn the differences into a plan.
- build the controls
Put the controls in place for the service in scope, and decide how each one leaves evidence.
- run the controls through the observation period
For a type II report, keep every control running with evidence for the whole period.
- go through the audit and use the report
Give the auditor what it needs, read the opinion and use the report as written.
- keep it going for the next period
Keep the controls running without a break and plan the next report.
what a certificate does and does not show
Read this before a customer asks you for one.
service companies whose customers ask for it in sales questionnaires
a licensed auditor's report on your controls
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.