Start with the buyer’s exact request
“Please provide SOC 2” does not define a project. Ask for the wording in the contract, questionnaire or supplier portal. Confirm whether the buyer expects Type 1 or Type 2, which legal entity and service the report should cover, the required date, and whether other evidence is requested alongside the report.
Do not assume every US buyer has the same requirement. A report for one platform or entity does not automatically cover every product in the group.
Type 1 and Type 2
Both concern a service organization’s system description and relevant controls. Type 1 addresses the design and implementation of controls at a point in time. Type 2 also addresses how controls operated over a period. The buyer’s procurement process determines which result is useful to them; the report scope and evidence period determine the preparation work.
| Question | What to establish |
|---|---|
| Report subject | Which entity, service and systems are included? |
| Report type | Is Type 1 acceptable, or is Type 2 required? |
| Criteria | Beyond security, are availability, processing integrity, confidentiality or privacy relevant? |
| Timing | When is the report required, and what interim evidence will the buyer accept? |
| Dependencies | How are cloud providers and other subservice organizations treated? |
What the organization needs to prepare
Business and technical owners first define the service boundary, data flows, access, infrastructure and external dependencies. They then compare existing practices with relevant controls, such as access review, change management, risk assessment, incident response, supplier oversight and backups. Useful evidence must show that the controls actually operate within the period and scope under examination.
A frequent gap is the distance between a written policy and day-to-day records. A policy may require periodic access reviews while tickets and approvals do not show who performed them or when. Resolve those differences before treating a document library as audit readiness.
Who issues the report
The organization owns its system and controls. A specialist may help scope the work, identify gaps and organize evidence. An independent CPA performs the SOC 2 examination and issues the report. AssureLane currently offers an entry point for requirement triage and coordination with specialists; the delivery team and scope are confirmed for each project.
Five practical next steps
- Keep the buyer’s exact wording and deadline.
- Confirm the entity, product and system boundaries with sales, security and engineering.
- Inventory existing controls, operating records and key suppliers.
- Discuss gaps, ownership and independent CPA arrangements with qualified specialists.
- Agree with the buyer on suitable interim communication without presenting a plan as an issued report.
Bring the procurement wording to the first conversation. Sensitive audit evidence is not needed for an initial discussion.
Two buyer situations require different paths
Situation A: the supplier terms explicitly require Type 2. Confirm the report period, product and contracting entity. Even if policies already exist, key controls need to operate and leave records across the relevant period. If procurement timing is tighter than evidence formation, discuss acceptable interim materials with the buyer instead of promising an unissued report.
Situation B: the buyer only asks for “independent security evidence.” Check whether the supplier policy accepts an existing report, ISO/IEC 27001 certificate, questionnaire or other evidence. Starting a SOC 2 engagement immediately may still leave the buyer’s product-scope or data-processing question unanswered.
Ownership and materials before kickoff
| Role | Starting responsibility | Important boundary |
|---|---|---|
| Business owner | Preserve buyer wording and confirm timing and contract scope | Cannot decide for the buyer what outcome they accept |
| Security and engineering | Explain system boundaries, actual practices and operating records | Policies alone do not prove operation |
| Readiness specialist | Help map gaps, owners and the evidence plan | Does not issue the independent attestation report |
| Independent CPA | Agree the examination arrangement and perform independent work | The conclusion depends on professional judgment |
For an initial conversation, bring the exact buyer wording, a one-page outline of the service and entities, and an inventory of existing controls and evidence. Do not upload full contracts, customer data or internal architecture to a public form.
Common misunderstandings
- “SOC 2 is a US regulatory certification.” It is an independent attestation report; buyer and contractual needs must be established for the specific situation.
- “A policy template is enough.” Operating controls and consistent evidence matter more than the number of templates.
- “The report ends all buyer questions.” A buyer may still review scope, period and exceptions or ask for additional evidence.
If the buyer has confirmed that a SOC 2 report is needed, read the SOC 2 readiness and CPA coordination pathway for project stages, company inputs and responsibilities.