The attestation North American buyers ask for. SOC 2 reports on how your organisation safeguards customer data against the AICPA's Trust Services Criteria — and is often the fastest way to unblock a stalled enterprise deal.
SOC 2 is an attestation report issued by a licensed CPA firm, not a certification. It evaluates your controls against up to five Trust Services Criteria: Security (always required), plus Availability, Processing Integrity, Confidentiality, and Privacy as relevant to your service.
It comes in two forms. Type I assesses whether controls are suitably designed at a single point in time. Type II assesses whether they operated effectively across a defined observation window — typically three to twelve months — and is the version most enterprise customers expect.
Because the framework maps closely to ISO 27001, organisations pursuing both can reuse much of the same control work across the two.
The default trust signal in the US market, and increasingly a prerequisite to closing mid-market and enterprise deals.
Demonstrates continuous, audited control of the data you process on customers' behalf.
Any vendor whose buyers send a security questionnaire before they sign.
We run the full programme — scoping, control build, and audit readiness — and coordinate the CPA firm. A Type I report can move quickly; a Type II report is gated by its observation window, so the timeline reflects the period your controls must demonstrably operate, not the effort to build them.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
If you sell software to US businesses, a security questionnaire usually arrives before the contract does, and it often asks for one thing: your SOC 2 report. It is the default trust signal in the US market and increasingly a prerequisite for closing mid-market and enterprise deals, including for UK and European companies selling into the US.
Type I or Type II? A Type I report describes whether your controls are suitably designed at a single point in time, so it can be issued relatively quickly. A Type II report tests whether those controls operated effectively across an observation window, typically three to twelve months, and is the version most enterprise buyers expect. Many companies get a Type I to unblock a stalled deal while the Type II observation window runs in parallel.
Choosing your criteria. Security is always in scope. Availability, Confidentiality, Processing Integrity and Privacy are added only when your customer commitments call for them, which keeps scope, cost and audit effort proportionate.
SOC 2 and ISO 27001 together. The two frameworks overlap heavily. US customers tend to ask for SOC 2, while UK, European and international customers more often ask for ISO 27001. If you sell in both markets we plan the controls once and reuse the evidence for both. See our ISO 27001 page.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. We run scoping, control build and audit readiness, and coordinate the licensed CPA firm that issues your report. Calls are scheduled around your working hours.
Timeline and cost. A Type I can move quickly. A Type II is gated by its observation window, so the timeline reflects how long your controls must demonstrably operate, not how long they take to build. Total cost has three parts: consultancy support, any compliance tooling you choose, and the CPA firm's audit fees. It depends on your size and scope, so we quote after a short scoping call. Book a free advisory session.
More guides: SOC 2 for startups and SOC 2 Type I vs Type II.
If a deal needs proof fast, a Type I gives you a report at a point in time while the Type II observation window runs in parallel. If you can wait, many companies go straight to Type II. We'll advise based on your sales pressure and starting maturity.
No — it's an attestation report signed by a licensed CPA firm. There's no certificate or pass/fail mark; the report describes your controls and the auditor's findings, which you then share with customers under NDA.
Yes. ISONEX is a remote-first consultancy and we deliver SOC 2 programmes for clients in the US, the UK, Europe and the GCC. Everything is done online, scheduled around your working hours. The SOC 2 report itself is issued by an independent licensed CPA firm.
Yes. SOC 2 is not limited to US companies. A UK or European company selling to US customers can obtain a SOC 2 report from a licensed CPA firm, and many do once US buyers start asking for it.
A Type I report can be reached relatively quickly once your controls are in place. A Type II depends on its observation window, typically three to twelve months. We set the timeline with you at the start, based on your starting maturity and sales pressure.
It depends on your company size, scope and existing controls. The total has three parts: consultancy support, any compliance tooling you choose, and the CPA firm's audit fees. After a short scoping call we can give you a clear quote for your situation.
US customers most often ask for SOC 2, while UK, European and international customers more often ask for ISO 27001. Many companies end up holding both, and the controls overlap significantly. See our ISO 27001 page for more.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session