# A buyer asks for SOC 2. What should you clarify first?

> SOC 2 is an independent attestation report about controls at a service organization. Before planning the work, confirm what the buyer means by SOC 2, which service is in scope, and when the report is needed.

Canonical page: https://assurelane.ai/en/frameworks/soc-2/
Updated: 2026-09-26 · Sources checked: 2026-09-26

## At a glance

- Full name: System and Organization Controls 2
- Issuer: Independent CPA firm (AICPA standards)
- Output: Type 1 or Type 2 attestation report (restricted use)
- Applies to: Service organisations providing SaaS, cloud or data services to businesses
- Region: Mainly North America; widely accepted globally
- Typical timeline: Type 1: ~2–4 months; Type 2 adds a 3–12 month period
- Validity: No formal expiry; buyers expect a report covering the last 12 months, renewed yearly

## Key dates

- 2017: Current Trust Services Criteria issued
- 2022: Revised points of focus
- 2026: AICPA works on updated SOC 2 criteria (AI and new technology)

## Start with the buyer's exact request

“Please provide SOC 2” does not define a project. Ask for the wording in the contract, questionnaire or supplier portal. Confirm whether the buyer expects **Type 1 or Type 2**, which legal entity and service the report should cover, the required date, and whether other evidence is requested alongside the report.

Do not assume every US buyer has the same requirement. A report for one platform or entity does not automatically cover every product in the group.

## Type 1 and Type 2

Both concern a service organization's system description and relevant controls. Type 1 addresses the design and implementation of controls at a point in time. Type 2 also addresses how controls operated over a period. The buyer's procurement process determines which result is useful to them; the report scope and evidence period determine the preparation work.

| Question | What to establish |
| --- | --- |
| Report subject | Which entity, service and systems are included? |
| Report type | Is Type 1 acceptable, or is Type 2 required? |
| Criteria | Beyond security, are availability, processing integrity, confidentiality or privacy relevant? |
| Timing | When is the report required, and what interim evidence will the buyer accept? |
| Dependencies | How are cloud providers and other subservice organizations treated? |

## What the organization needs to prepare

Business and technical owners first define the service boundary, data flows, access, infrastructure and external dependencies. They then compare existing practices with relevant controls, such as access review, change management, risk assessment, incident response, supplier oversight and backups. Useful evidence must show that the controls actually operate within the period and scope under examination.

A frequent gap is the distance between a written policy and day-to-day records. A policy may require periodic access reviews while tickets and approvals do not show who performed them or when. Resolve those differences before treating a document library as audit readiness.

## Who issues the report

The organization owns its system and controls. A specialist may help scope the work, identify gaps and organize evidence. **An independent CPA performs the SOC 2 examination and issues the report.** AssureLane currently offers an entry point for requirement triage and coordination with specialists; the delivery team and scope are confirmed for each project.

## Five practical next steps

1. Keep the buyer's exact wording and deadline.
2. Confirm the entity, product and system boundaries with sales, security and engineering.
3. Inventory existing controls, operating records and key suppliers.
4. Discuss gaps, ownership and independent CPA arrangements with qualified specialists.
5. Agree with the buyer on suitable interim communication without presenting a plan as an issued report.

Bring the procurement wording to the first conversation. Sensitive audit evidence is not needed for an initial discussion.

## Two buyer situations require different paths

**Situation A: the supplier terms explicitly require Type 2.** Confirm the report period, product and contracting entity. Even if policies already exist, key controls need to operate and leave records across the relevant period. If procurement timing is tighter than evidence formation, discuss acceptable interim materials with the buyer instead of promising an unissued report.

**Situation B: the buyer only asks for “independent security evidence.”** Check whether the supplier policy accepts an existing report, ISO/IEC 27001 certificate, questionnaire or other evidence. Starting a SOC 2 engagement immediately may still leave the buyer's product-scope or data-processing question unanswered.

## Ownership and materials before kickoff

| Role | Starting responsibility | Important boundary |
| --- | --- | --- |
| Business owner | Preserve buyer wording and confirm timing and contract scope | Cannot decide for the buyer what outcome they accept |
| Security and engineering | Explain system boundaries, actual practices and operating records | Policies alone do not prove operation |
| Readiness specialist | Help map gaps, owners and the evidence plan | Does not issue the independent attestation report |
| Independent CPA | Agree the examination arrangement and perform independent work | The conclusion depends on professional judgment |

For an initial conversation, bring the exact buyer wording, a one-page outline of the service and entities, and an inventory of existing controls and evidence. Do not upload full contracts, customer data or internal architecture to a public form.

## Common misunderstandings

- **“SOC 2 is a US regulatory certification.”** It is an independent attestation report; buyer and contractual needs must be established for the specific situation.
- **“A policy template is enough.”** Operating controls and consistent evidence matter more than the number of templates.
- **“The report ends all buyer questions.”** A buyer may still review scope, period and exceptions or ask for additional evidence.

If the buyer has confirmed that a SOC 2 report is needed, read the [SOC 2 readiness and CPA coordination pathway](https://assurelane.ai/en/services/soc-2/) for project stages, company inputs and responsibilities.

## Sources

- [AICPA & CIMA — SOC Suite of Services](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2)
- [AICPA & CIMA — Trust Services Criteria](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)

---
General information only; not legal, audit or certification advice. AssureLane does not issue SOC 2 reports or ISO certificates.