No UK law requires SOC 2. A UK company needs it when a customer, usually in the US, makes a SOC 2 report a condition of buying, typically because you host, process or have access to their data. If your buyers are mainly in the UK or Europe, an ISO 27001 certificate is more widely recognised and often accepted instead.
SOC 2 questions tend to arrive late in a sales cycle, when a US prospect’s security team sends its vendor checklist. The pressure to say yes is real, but a SOC 2 examination is a significant commitment. This article explains what SOC 2 actually is, when a UK company genuinely needs one, and what to check before you commit.
Executive Summary & Key Takeaways
- SOC 2 is an attestation report issued by a licensed CPA firm under AICPA standards. It is not a certificate and there is no “SOC 2 certified” status.
- Security is always in scope. Availability, processing integrity, confidentiality and privacy are added only where they are relevant to your service.
- A Type 1 report covers control design at a point in time. A Type 2 report also tests whether controls operated effectively over a period, which gives customers more assurance.
- If your buyers are in the UK or Europe, ISO 27001 is usually the stronger credential. If they are in the US, ask whether they accept ISO 27001 before committing to SOC 2.
- The AICPA has warned publicly about vendors promising fast, cheap SOC 2 reports. Choose the audit firm carefully.
What SOC 2 actually is
SOC 2 is an examination of a service organisation’s controls relevant to security, availability, processing integrity, confidentiality or privacy. The AICPA sets the standards, and its 2017 Trust Services Criteria (with revised points of focus from 2022) are the benchmark the auditor uses (AICPA, retrieved 16 October 2026).
The report contains three main parts: your management’s description of the system, your assertion about it, and the CPA firm’s opinion. A Type 2 report also includes a description of the auditor’s tests of controls and the results. Because of that detail, a SOC 2 report is generally a restricted-use document, intended for specified users such as customers and prospective customers rather than for publication (AICPA, retrieved 16 October 2026).
If you want something you can publish, a SOC 3 report covers the same criteria without the detailed test results and is designed as a general-use report that can be freely distributed (AICPA, retrieved 16 October 2026).
The five Trust Services categories
| model | What it addresses | Included when |
|---|---|---|
| Security (the "common criteria") | Protection of information and systems against unauthorised access and damage | Always |
| Availability | Systems are available for operation and use as committed | You make uptime or recovery commitments |
| Processing integrity | Processing is complete, valid, accurate and timely | Customers rely on your processing outputs, such as payments or calculations |
| Confidentiality | Information designated as confidential is protected | You handle customers’ confidential business data |
| Privacy | Personal information is collected, used, retained and disposed of as committed | Personal data is central to the service |
Choosing categories is a scoping decision. Adding one you do not need raises the cost and the number of controls the auditor must test, without making the report more useful to your customers.
Type 1 or Type 2
| model | Type 1 | Type 2 |
|---|---|---|
| What the auditor gives an opinion on | Fair description of the system and suitable design of controls | The same, plus whether controls operated effectively |
| Timeframe | As of a specified date | Throughout a specified period |
| Includes auditor’s tests and results | No | Yes |
| What it tells a customer | The controls exist and are designed sensibly | The controls actually worked over time |
Check which type your customer’s vendor policy asks for. A Type 1 can be a useful first step if a deal needs evidence quickly, but if the customer wants proof that controls work over time, expect them to ask when the Type 2 will follow.
When a UK company genuinely needs SOC 2
In our experience, the need almost always comes from customers rather than regulation. The common triggers are:
- A US enterprise customer or prospect whose vendor risk policy names SOC 2 as the required evidence for suppliers that handle its data.
- A US-headquartered buyer with UK operations that applies its global procurement standard to UK suppliers.
- A SaaS or platform business planning US expansion, where buyers compare you with competitors who already hold SOC 2 reports.
- Investor or acquirer due diligence by US parties, who may ask for a SOC 2 report as part of their review.
If none of these apply, SOC 2 is probably not your next step. Our comparison of Cyber Essentials, ISO 27001 and SOC 2 explains how the three fit together for UK businesses.
When something else may do
Before committing, ask the customer what they will accept. Options that sometimes satisfy the same request include:
- An ISO 27001 certificate. Some US buyers accept a current certificate from an accredited certification body, with a scope that covers the service they are buying. The AICPA itself publishes a mapping between the Trust Services Criteria and ISO 27001 (AICPA, retrieved 16 October 2026), so the controls overlap heavily. Our ISO 27001 support covers that route.
- An ISAE 3000 assurance report. ISAE 3000 (Revised) is the international standard for assurance engagements other than audits of historical financial information, and ISAE 3402 covers reports on controls at service organisations relevant to customers’ financial reporting (IAASB and ICAEW, retrieved 16 October 2026). Some buyers accept these in place of SOC 2, but confirm with your customer before commissioning one.
- A completed security questionnaire with evidence. For smaller contracts, a well-evidenced questionnaire and recent penetration test summary may be enough.
Choosing a SOC 2 audit firm
A SOC 2 report can only be issued by a licensed CPA firm. That matters more than it used to. The AICPA has said it is looking into allegations about the business practices of a compliance vendor offering SOC services, and that it will act where auditors have not followed professional standards, are not enrolled in peer review, or are unlicensed (AICPA, retrieved 16 October 2026).
The AICPA’s Journal of Accountancy has also reported concern that some tool vendors promise SOC 2 “compliance” in weeks or even hours, noting that “compliance” is a term never used in SOC 2 examinations (Journal of Accountancy, February 2026, retrieved 16 October 2026). AICPA ethics guidance flags warning signs such as promotional promises of a “clean audit” or “100% pass rate” (AICPA, April 2026, retrieved 16 October 2026).
When choosing a firm, check:
- that the signing firm and individuals are licensed CPAs and enrolled in peer review;
- who actually performs the fieldwork, and whether they will sample your systems themselves;
- whether the firm’s independence could be affected by its relationship with any compliance tool you use;
- that the scope, categories and period match what your customers need.
A report from a credible firm takes longer to earn, but it is the one your customer’s security team will trust.
What drives effort and cost
We do not publish prices, but the drivers of a SOC 2 programme are consistent:
- Readiness. How many controls already exist and produce evidence. A business already running ISO 27001 starts much further ahead.
- Scope. The number of systems, products, locations and Trust Services categories in the report.
- Type and period. A Type 2 requires controls to operate for a period before the auditor can test them, so it costs more time and fieldwork than a Type 1.
- Subservice organisations. If you rely on cloud providers, the report must explain how their controls interact with yours.
- Audit firm fees. These are set by the CPA firm and vary with scope and sampling.
- Internal effort. Evidence collection, control owners’ time and responding to auditor requests, every year you renew.
Falx is not a CPA firm and cannot issue SOC 2 reports. We help with readiness: gap assessment against the Trust Services Criteria, building and evidencing the controls, and preparing your team for the auditor. Our assurance service covers that work.
Common mistakes
- Saying “we are SOC 2 compliant” or “SOC 2 certified”. Neither status exists. You have a report with an opinion for a defined scope and date or period.
- Starting a SOC 2 without asking whether ISO 27001 would be accepted. For UK businesses with mixed customers, ISO 27001 often covers more buyers for similar effort.
- Choosing an auditor on speed and price alone. A boilerplate report may not survive scrutiny by an experienced customer security team.
- Including every Trust Services category. Scope only what your service commitments require.
- Treating the first report as the finish line. Customers will ask for a current report each year, so controls must keep operating.
Frequently asked questions
Should we do a Type 1 report before a Type 2?
It can help if a customer needs evidence quickly or if you are unsure your controls are ready. A Type 1 confirms design at a point in time, then the Type 2 period can start once controls are stable. If you are confident in your controls and your customer can wait, going straight to a Type 2 avoids paying for two examinations.
Our hosting provider has a SOC 2 report. Does that cover us?
No. Their report covers their controls, not yours. Your own SOC 2 report will describe how you rely on them as a subservice organisation, and your access management, change control, monitoring and incident response still need to be tested.
Can we publish our SOC 2 report on our website?
Generally not, because a SOC 2 report is a restricted-use document intended for customers and other specified parties. If you want something public, ask your audit firm about a SOC 3 report, which is designed for general use. The SOC 2 report itself can still be shared with customers and prospects, for example through a trust portal or under a non-disclosure agreement.
Is SOC 2 more rigorous than ISO 27001?
They measure different things. ISO 27001 certifies that you run a management system for information security; a SOC 2 Type 2 report tests whether specific controls operated over a period and shows the results. Which one carries more weight depends on who is reading it.
Getting started
If a US customer has asked for SOC 2, start by confirming exactly what they need: Type 1 or Type 2, which categories, and whether ISO 27001 would be accepted instead. Then assess how far your current controls are from the Trust Services Criteria. Our assurance team can run that readiness assessment and prepare you for the CPA firm. Talk to our team to get started.
Ashley Argyle
Writing about cyber security and technology at Falx.
