▸ SOC 2 · US enterprise sales

Getting audit-ready for SOC 2 when a US buyer asks for the report

SOC 2 readiness for startups selling to US companies usually starts with an email from a buyer's procurement team: send your SOC 2 report, or tell us when you will have one. We take the road to the audit off your plate: we compare what you actually run with the AICPA criteria, close the gaps, write the system description and collect the evidence, so the CPA firm starts testing from finished material.

Discuss your case Whole section

▸ Cybersecurity

Who it is for: SaaS, fintech and API companies with US buyers
Criteria: AICPA Trust Services Criteria (2017, revised 2022)
Outcome: Ready for the CPA firm's examination
Sources: 6
Sources checked: 2026-10-23

Ask a partner · written reply within 24 hours

Why US buyers ask for a SOC 2 report

A company that hands its data to an outside service has to understand the risk of that connection, and a SOC 2 report gives it an independent auditor's opinion on your controls. That is why the request appears in procurement questionnaires and contracts well before signature.

The AICPA describes SOC as a suite of services CPAs provide on the controls of a service organization. A SOC 2 report addresses controls relevant to five categories: security, availability, processing integrity, confidentiality and privacy. The AICPA guide says customers and business partners need information about the design, operation and effectiveness of those controls.

Who reads the report on the buyer's side

Security, legal and procurement teams. Use of a SOC 2 report is generally restricted, so it goes out under NDA; the AICPA's SOC 3 is the general use version with less detail.

Until you have a report, the buyer judges you on questionnaires and documents, and a readiness plan with an audit date helps keep the deal moving.

SOC 2 Type 1 vs Type 2: which report to start with

A Type 1 report describes the system and assesses the design of controls as of a specified date. A Type 2 report contains the same opinions and adds an opinion on how the controls operated throughout a period, so it needs evidence collected over that period.

Choosing the order of reports

If the buyer accepts a report on control design, Type 1 clears the deal question sooner. Some buyers ask for Type 2 from the start. Then the start date of the observation period matters: from that day every control has to leave a trace in logs, tickets and meeting notes. You agree the length of the period with the auditor, and before it starts we set up processes so the evidence collects itself.

SOC 2 readiness assessment: what we check before the auditor

A readiness assessment compares what is actually configured in your company with the AICPA criteria and lists every gap with a priority. Its output is a work plan you can show both the buyer and the auditor.

First we set the system boundary: which product, environments, clouds, vendors and data are in the report, and which of the five categories you include to match what you promise customers. Then we go through the areas where young teams most often have gaps:

Access. MFA, granting and revoking rights, access reviews.
Change management. How code reaches production and who approves it.
Logging. What is logged, who watches alerts, how long records are kept.
Vendors. Clouds and SaaS tools that process customer data.
Incidents and continuity. Response procedure, backups, tested restores.
People. Onboarding, offboarding, training.

System description and management's assertion

The AICPA's illustrative report contains management's assertion, the description of the system, the service auditor's report, and the tests of controls with their results. The first two are written by the company, and we draft them from your real processes in line with the DC 200 description criteria.

SOC 2 vs ISO 27001 when you enter the US market

SOC 2 is a CPA firm's report on the controls of your system; ISO/IEC 27001 is certification of an information security management system by a certification body. The choice follows what your buyer wrote into the contract or questionnaire.

Many controls overlap: access, logging, vendors, incident response, so one base of policies and evidence serves both paths. If you sell to the US and Europe, plan it for both frameworks from day one. More on the second framework in our ISO 27001 guide for fintech.

How we take a startup to the audit

A paid 30-minute consultation and a scope letter: systems, dates, fixed price.
Readiness assessment with a plain-language gap report and a technical annex.
Remediation by us or together with your developers; a person checks every finding.
Documents: policies, system description, draft management's assertion.
Re-check and hand-over of the material to the CPA firm you choose.

If you still need the US entity behind the contract, our US incorporation team handles it. Hands-on infrastructure work in Canada is done by the group's IT brand itopsi.com.

What the AICPA material says about SOC 2

Requirement	What it means	Source
SOC is a suite of services CPAs provide on the controls of a service organization	Only a CPA firm issues the SOC 2 report; getting ready for it is separate work	AICPA & CIMA, SOC suite
SOC 2 examines the system description and controls relevant to security, availability, processing integrity, confidentiality or privacy	You choose the categories that match your promises to customers	AICPA, SOC 2 Guide
Controls are evaluated against the 2017 Trust Services Criteria with revised points of focus (2022)	Preparation follows the current edition of the criteria	AICPA, SOC 2 Guide
Type 1 is as of a specified date; Type 2 adds an opinion on operating effectiveness throughout a period	For Type 2, evidence builds up over the whole observation period	Journal of Accountancy (AICPA & CIMA)
The report includes management's assertion, the system description, the auditor's report and tests of controls	The company writes the assertion and the description before fieldwork	AICPA, Illustrative SOC 2 report
SOC 3 reports are general use reports and can be freely distributed	SOC 2 goes to buyers under NDA; SOC 3 is the version for your website	AICPA & CIMA, SOC 3

What you receive

A readiness report: gaps per area, priorities and a dated plan
Policies and procedures written from the way your team actually works
A draft system description and management's assertion for the report
An evidence folder mapped to the criteria, plus fixed settings from the agreed list
A re-check after remediation and a hand-over pack for the CPA firm

What we need from you

A project owner on your side and a contact for your technical lead
The list of clouds, SaaS tools and contractors that touch customer data
Read access to cloud consoles, the repository and ticketing, from an agreed list
The buyer's requirement: the procurement questionnaire or the SOC 2 clause in the contract
A signed scope letter before any checks start

Boundaries

An independent CPA firm issues the SOC 2 report under AICPA standards; we prepare you for its examination
You sign management's assertion and you decide which controls to adopt
The auditor's opinion and the buyer's decision are theirs; we give no guarantee on the audit outcome
Legal review of the customer contract belongs with a lawyer
A penetration test, if the buyer requires one, is arranged on request with a separate provider

Risks of preparing alone, with a chatbot or with a freelancer

Alone: The team copies policy templates from the internet, and the audit shows nobody follows the processes they describe. The Type 2 period has to start again.
Chatbot: Produces a polished set of documents about controls you do not have. It cannot see your systems, and you are the one signing management's assertion.
Freelancer: Often brings someone else's policies and asks for admin access to everything. Without a scope letter and a confidentiality agreement, responsibility for the result stays vague.

Frequently asked questions

Q/01Is SOC 2 mandatory for a startup selling to US companies?

Q/02What is the difference between SOC 2 Type 1 and Type 2?

Q/03How long does SOC 2 readiness take?

Q/04How much does SOC 2 readiness cost?

Q/05Does SOC 2 still make sense if we are working towards ISO 27001?

Sources (checked 2026-10-23)

System and Organization Controls: SOC Suite of ServicesAICPA & CIMA
SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or PrivacyAICPA & CIMA
Illustrative SOC 2 Report with Illustrative System DescriptionAICPA & CIMA
Illustrative Service Auditor's SOC 2 Type 2 ReportAICPA & CIMA
SOC 3 — SOC for Service Organizations: Trust Services Criteria for General Use ReportAICPA & CIMA
Explaining the 3 faces of SOCJournal of Accountancy (AICPA & CIMA)

Next step · written reply within 24 hours

Start with one line about your task

One line is enough. A partner reads it and replies in writing within 24 hours.

A partner replies in writing within 24 hours
A written quote follows your request
Nothing is paid before you accept the quote

Or write to hello@innovacg.com