Governance and Compliance

What Is SOC 2?

SOC 2 (System and Organization Controls 2) is an audit report, performed by an independent accounting firm following standards set by the AICPA (the American accounting institute), that evaluates a technology company's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. It is how a software or cloud provider proves to a customer that it protects the data it receives, without revealing architecture secrets.

Zamak TechnologiesUpdated on July 10, 2026

How a SOC 2 audit works

SOC 2 is not a badge you buy, it is a report issued after an independent audit. The path follows clear stages.

Choose the scope (the Criteria)

Security is mandatory in every SOC 2 report; availability, processing integrity, confidentiality and privacy are added based on what the audited company's customers require.

Implement and run the controls

Access control, monitoring, change management, incident response, backup: the technical and organizational controls that address the chosen Criteria.

An independent accountant audits

Unlike ISO 27001 (a certification body), SOC 2 is issued by a licensed accounting firm, following AICPA standards.

Receive the report, not a certificate

The result is a detailed report, usually shared under an NDA with customers and prospects, not a public badge.

Source: AICPA, Trust Services Criteria (2017, with points of focus revised in 2022).

SOC 2 Type I and Type II: which is which

Type I Assesses whether controls are designed correctly at a single point in time. Faster to obtain, but it only proves the design exists, not that it works day to day.
Type II Assesses whether controls actually operated effectively over an observation period. It is the report most enterprise customers ask for, because it proves real operation, not intent.

Why SOC 2 became a B2B sales prerequisite

possible Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy)

of the 5 Criteria is mandatory in every SOC 2 report: security

Common Criteria categories (CC1-CC9), derived from the COSO framework, that underpin every report

To sell software or a cloud service to enterprise and regulated buyers, not having a SOC 2 report tends to stall the deal before the proposal even reaches the table. Security is the only one of the five Criteria mandatory in every report, which already reveals the market's priority: before discussing availability or privacy, the buyer wants to know if the vendor protects what it receives. The Type II report, which observes operation over a period, is the standard that builds trust because it does not depend on the vendor's word, it depends on what an independent auditor actually verified.

How a company prepares for SOC 2

The path to a first report usually follows this order:

Scope it around your customersAsk which Criteria customers and prospects actually require before taking on the cost of Criteria no one will ask for.
Close the gaps before the auditA readiness assessment maps what is missing before paying for the formal audit, which is expensive to redo.
Run a Type I before a Type II if the timeline is tightCompanies under commercial pressure sometimes use a Type I as interim proof while they build up the Type II observation period.
Treat the report as a process, not an eventSOC 2 renews, usually every 12 months. Controls have to keep operating between reports.

In practice

The question that reveals whether a company is ready: if an auditor asked today to see the record of who approved a specific employee's access three months ago, would that record exist?

How Zamak supports the journey to SOC 2

Zamak Technologies delivers the technical controls a SOC 2 report requires (access control, monitoring, change management, backup, incident response) and supports evidence mapping on a compliance platform, within Governance and Compliance in the Zamak Method. The Compliance Audit Express is the free first step to see where the company stands.

Frequently asked questions about SOC 2

Is SOC 2 a certificate?

Not technically. It is an audit report, not a certificate issued by an accrediting body like ISO 27001's. But the market usually treats “having a SOC 2” as equivalent to being certified.

Does every technology company need SOC 2?

Not by law. It is a market requirement, most common among SaaS and cloud service providers whose enterprise buyers often require the report before signing.

What is the difference between SOC 1 and SOC 2?

SOC 1 evaluates controls that affect a customer's financial reporting (relevant for payroll providers, for example). SOC 2 evaluates security, availability and the other Trust Services Criteria, the report most technology companies pursue.

How long does a SOC 2 report last?

It does not expire like a certificate, but it covers a specific period (Type II usually observes several months) and the market expects renewal, typically annual, to keep trust current.

Can a small company get a SOC 2?

Yes. Scope and effort vary with the size of the operation, but the framework does not require a minimum size.

Is a SOC 2 report public?

Usually not. It is shared under an NDA with customers and prospects, unlike an ISO certificate, which tends to be more openly shared.