SOC 2 is an assurance framework defined by the AICPA for service organizations that store, process or transmit customer data. Rather than a certificate, it results in an independent auditor's report on the design (Type I) and operating effectiveness (Type II) of an organization's controls.
The five Trust Services Criteria
SOC 2 is built on five Trust Services Criteria: Security (always in scope), plus Availability, Confidentiality, Processing Integrity and Privacy, included based on what the organization commits to its customers.
Security, the 'common criteria', covers governance, access control, change management, risk, monitoring and incident response, much of which overlaps with ISO 27001 Annex A.
SOC 2 vs ISO 27001
The two are complementary. ISO 27001 certifies a management system against an international standard; SOC 2 produces an attestation report tailored to the criteria a service organization commits to. Many providers pursue both, and the underlying controls and evidence largely overlap.
If your customers are predominantly North American, SOC 2 is often the first ask; for international and Gulf markets, ISO 27001 frequently leads. A shared control library lets you satisfy both efficiently.
Preparing for an examination
Define your system boundary and the criteria in scope, implement the controls, and, crucially for a Type II, operate them consistently over the review period while retaining evidence. Confirm current requirements with your auditing firm, as professional guidance evolves.
Keep reading
Meet GRCLens at the G[P]RC Summit Africa 2026 in Johannesburg
We are growing: in the same week as Kuala Lumpur, GRCLens and Security Solution Consultants are exhibiting at the G[P]RC Summit Africa in Johannesburg on 10 and 11 November 2026.
Meet GRCLens at the PCI SSC 2026 Asia-Pacific Community Meeting in Kuala Lumpur
GRCLens and Security Solution Consultants are exhibiting at the PCI SSC 2026 Asia-Pacific Community Meeting Vendor Showcase in Kuala Lumpur on 11 and 12 November 2026.
From incident to crisis: how ISO/IEC 27035, ISO 22320 and ISO 22361 work together
Incident handling, incident command and crisis leadership are usually run by three teams with three plans. Read together, ISO/IEC 27035, ISO 22320 and ISO 22361 describe one escalation, and the hand-offs between them are where most crises go wrong.