SOC 2 explained for European companies

SOC 2 is a US audit report that describes a service provider's security controls and gives an independent firm's opinion on their design and, in its Type 2 version, on how they operated over time. Little known in Europe, it becomes essential as soon as a European SaaS vendor wants to sign customers in the United States. Here is how it works and how it fits with ISO 27001.

SOC stands for System and Organization Controls. It is a family of reports defined by the AICPA, the American Institute of Certified Public Accountants. As Microsoft puts it, these reports examine the services provided by a service organisation so that its customers can assess and address the risk of outsourcing.

A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality and privacy. It is performed by an independent CPA firm under AICPA attestation standards, notably SSAE 18. Three points to keep in mind from the outset:

• It is not a certification. The auditor issues a report and an opinion, not a certificate.
• The report is confidential. It is usually shared under a non-disclosure agreement; providers such as AWS also publish a SOC 3 report, a public, summarised version.
• It is not about the accounts. Its cousin, SOC 1, covers controls relevant to customers' internal control over financial reporting; SOC 2 covers the security of the service.

The SOC 2 framework is called the Trust Services Criteria. The current version dates from 2017; its points of focus, which illustrate each criterion, were revised in 2022 without changing the criteria themselves, as an EY briefing explains. The criteria are grouped into five categories.

Security is the only mandatory category. It contains the common criteria, numbered CC1 to CC9, which apply to every report: control environment, communication and information, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation, as defined in the AICPA criteria. The other four categories are added according to the commitments you make to customers.

This is the most common question. Google Cloud sums it up: a Type 1 report covers the design of controls at a specific point in time; a Type 2 report covers their design and operating effectiveness over a period. In other words, Type 1 answers “are the right controls in place?” and Type 2 answers “did they work throughout the period?”.

A SOC 2 report runs to dozens of pages. It mainly includes:

• the auditor's opinion on the fairness of the system description and on the controls;
• the system description written by the company: services, infrastructure, software, people, procedures, data and the providers it relies on;
• the list of controls, mapped to the Trust Services Criteria;
• for a Type 2, the tests performed and their results, including exceptions.

If you are on the other side, buying a US service, this is the document to read, not just its first page. Check the period covered, the scope (is the service you buy included?), the categories and the exceptions. Our article on the vendor security questionnaire explains how to combine this evidence with your own questions.

The two overlap widely, so much so that the AICPA publishes a mapping between the Trust Services Criteria and ISO 27001. Yet they do not say the same thing.

No US law requires SOC 2. The need comes from buyers. In the United States, supplier assessment has been built around this report: your prospects' security and procurement teams expect it in their onboarding process, alongside a security questionnaire. Without a report, a vendor faces longer questionnaires, on-site audits or simply being dropped from the tender.

An ISO 27001 certificate helps but does not always replace the report: the buyer wants to see tested controls and exceptions, not just the existence of a management system. Conversely, to sell in France and Europe, ISO 27001 remains the reference, supplemented in some sectors by French schemes such as HDS or SecNumCloud, or by TISAX in the automotive industry. Many vendors targeting both markets therefore run both efforts in parallel, with a single set of controls.

The same reasoning works the other way round. If you buy a service from a US vendor, asking for its SOC 2 Type 2 report is a good third-party risk management habit, provided you read it and draw your own conclusions.

• Define the scope. Which service, which teams, which categories? Start from your contractual commitments.
• Choose the auditor early. Only a firm entitled under AICPA standards can issue the report. In practice, a US firm or the US entity of an international network.
• Run a gap assessment. Compare your practices with the common criteria. If you have an ISO 27001 ISMS, the AICPA mapping speeds this up.
• Produce evidence as you go. Type 2 is played out over the period: access reviews, change tickets and restore tests must leave a dated trail.
• Start with a Type 1 if needed, then begin the Type 2 observation period.
• Plan the renewal, so reports follow on with no gap in coverage.

Keeping several overlapping frameworks up to date is the real cost of this kind of effort. A frameworks module that links frameworks together avoids assessing the same control twice.