AICPA Trust Services Criteria · Attestation report · United States
What is SOC 2?
SOC 2 is an attestation report, not a certificate. A CPA firm examines a service organisation's controls against the AICPA's Trust Services Criteria for security and, optionally, availability, processing integrity, confidentiality and privacy, and issues an opinion. A Type 1 report covers control design at a point in time; a Type 2 report covers operating effectiveness over a period.
Sources: 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022), AICPA; SOC 2 Reporting on an Examination of Controls at a Service Organization, AICPA Guide, updated 15 Oct 2022; System and Organization Controls: SOC suite of services, AICPA; Exposure drafts: proposed 2027 SOC 2 Trust Services Criteria and Description Criteria, AICPA; SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, Cybersecurity and Cyber Resilience Framework for SEBI Regulated Entities
Key facts
| Owner | AICPA (the Association of International Certified Professional Accountants), whose Assurance Services Executive Committee (ASEC) writes the Trust Services Criteria and the Description Criteria |
|---|---|
| Criteria in use | 2017 Trust Services Criteria, with revised points of focus issued in 2022. The AICPA published exposure drafts of proposed 2027 Trust Services Criteria and Description Criteria on 26 Oct 2026; they are not yet final |
| Structure | Five categories: security, availability, processing integrity, confidentiality and privacy. Security is made up of the common criteria (CC1 to CC9) and is in every report; the other four are added when a customer or contract calls for them. Each criterion carries points of focus that the auditor uses to judge whether the controls meet it |
| What is mandatory | Nothing by law. Inside the engagement, management writes a description of the system (against the AICPA's 2018 Description Criteria, with revised implementation guidance 2022) and signs an assertion; the CPA firm examines both under the AICPA attestation standards. Security must be in scope; everything else is your choice |
| Report types and validity | Type 1: the auditor opines on whether controls are suitably designed at a stated date. Type 2: the auditor also tests whether the controls operated effectively over a review period, and lists every test and its result. Neither carries a certificate or an expiry date. A Type 2 report speaks only to its review period, so customers ask for a report whose period ended recently, and most service organisations commission a new Type 2 report every year |
| Accreditation | None. There is no accreditation body for SOC 2 and no register of accredited auditors. The firm is a CPA firm licensed by a US state board of accountancy, follows the AICPA's attestation standards (the current SOC 2 guide, updated 15 Oct 2022, reflects SSAE 20 and 21) and is subject to AICPA peer review |
| Who audits in India | A CPA firm practising under AICPA standards, wherever its client sits. There is no Indian equivalent: Indian companies engage the Indian offices of US CPA firms or US firms working remotely. |
| Cost in India | Not published yet. Infofacility will post an Indian price range, with what it covers, once it has three comparable quotes. |
| Time to report | A Type 2 report cannot be issued until its review period has run. |
| Pairs with | ISO 27001 (the control evidence overlaps heavily, and many Indian companies hold both), ISO 27701 or the privacy category where personal data is in scope, and GDPR and the DPDP Act 2023 for the law behind the privacy criteria |
Who needs it
- No law requires SOC 2, in India or in the United States. You pursue it because a customer asks for it before signing or renewing. US procurement and vendor-risk teams treat a current Type 2 report as the standard evidence that a SaaS or IT services provider controls the systems that hold their data, and many will not onboard a vendor without one. For Indian SaaS, BPO and IT services companies selling to US enterprises, it is usually the first compliance document a buyer asks for, often ahead of ISO 27001.
- Because SOC 2 is an attestation, you set the scope: which systems, which categories beyond security, and which period. A young company with one product and US customers typically starts with a security-only Type 1, follows it with a Type 2 over a short period, then settles into an annual Type 2. A larger provider adds availability and confidentiality because its contracts promise uptime and specific data handling, and adds privacy when it processes personal data on behalf of customers.
- Indian regulators do not refer to SOC 2. SEBI's Cybersecurity and Cyber Resilience Framework (circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 of 20 August 2024) requires ISO 27001 certification for market infrastructure institutions and Qualified REs and audits by CERT-In empanelled auditing organisations; it does not mention SOC 2. If your customers are Indian banks or SEBI-regulated firms, expect them to ask for ISO 27001 or a CERT-In empanelled audit instead. SOC 2 opens doors abroad; it rarely satisfies an Indian regulator on its own.
How certification works
Step 1
Choose the categories and the system boundary
Security is always in. Add availability, processing integrity, confidentiality or privacy only where a customer or contract needs it. Define the system: the product, infrastructure, people, procedures and data that the report will describe.
Step 2
Map your controls to the criteria
For each criterion (TSC CC6.1 on logical access, for example) write down the control that meets it, who runs it, how often, and what evidence it leaves. Gaps found here are cheaper to fix than gaps found by the auditor.
Step 3
Run a readiness assessment
Have the CPA firm, or an adviser, review the design before the period starts. A Type 1 report at this point gives customers something to read while the Type 2 period runs.
Step 4
Write the system description and management's assertion
The description follows the AICPA's Description Criteria and explains the system, the control environment and any subservice organisations such as your cloud provider. Management signs the assertion that the description is fair and the controls are suitably designed and operating.
Step 5
Operate for the review period
Keep the evidence as you go: access reviews, change tickets, incident records, vendor reviews, background checks. The auditor samples across the whole period, so a control that lapsed for a quarter will show up as an exception.
Step 6
Fieldwork and the opinion
The CPA firm tests each control, documents exceptions and writes the opinion. A qualified opinion or a long exceptions list is still a report; customers read it, so fix the causes before the next period.
Step 7
Keep it current
Start the next review period the day the last one ends, so there is never a gap a customer can point to. Bridge letters cover the weeks between the period end and the report date.
Get there with Infofacility
GRC · Infofacility service
SOC 2 Type 2 readiness
Scope, controls and evidence ready for your auditor, then support through the observation period. 8 to 12 weeks, then the observation period.
Request a callbackQuestions
Is SOC 2 a certification?
No. SOC 2 is an attestation engagement: a CPA firm examines your controls and issues an opinion in a report. There is no certificate, no registration number and no accreditation body. Anyone claiming to be "SOC 2 certified" means they hold a report; ask for the report itself, check the period it covers and read the exceptions.
Type 1 or Type 2: which should an Indian company get first?
Type 1 is faster because it looks only at control design at one date, so it is a reasonable first step when a customer needs something now. Type 2 is what most US buyers eventually require, because it shows the controls operated over a period. Many companies do both: a Type 1 to start, then a Type 2 once a review period has run.
Can an Indian chartered accountant issue a SOC 2 report?
SOC 2 is an AICPA engagement carried out under AICPA attestation standards by a CPA firm. An Indian chartered accountancy firm without a US CPA practice can issue other assurance reports, but not a SOC 2 report. In practice Indian companies work with the Indian offices of US CPA firms or with US firms auditing remotely.
We already hold ISO 27001. Do we still need SOC 2?
If your customers ask for it, yes. The two overlap heavily in the controls they expect, so a working ISMS makes a SOC 2 engagement much faster, but ISO 27001 is a certificate against a standard and SOC 2 is an auditor's opinion on your specific system, and US buyers often want the second. Infofacility's comparison sets the two side by side.
Change log
4 Nov 2026 First version.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators