SOC 2

As handing data to other companies became normal, one question started repeating: can we put our customers' information into this vendor?

At first everyone asked separately. Each buyer built their own form — where data is stored, whether it's encrypted in transit, which employees can see customer data, how many hours until you notify us of an incident — anywhere from dozens to hundreds of questions. On the answering side the work never ends. Twenty customers means twenty rounds. The questions are similar but the forms differ, so it gets rewritten from scratch every time.

The asking side had no grounds to believe the answers either. What comes back in a spreadsheet is what the vendor wrote about itself. A claim that data is encrypted can't be verified from the claim. Verifying it means going in and looking at the systems, and twenty customers can't each do that.

SOC 2 exists so the verification happens once and gets shown to many. An external auditor comes in, examines, and issues a report; the vendor sends that one report to twenty buyers. The cost of trust moves from every buyer to one vendor, which is cheaper in total even though it's more expensive for the vendor.

What it removes is answering the same questions twenty times, and the inability to verify those answers.

The structure has three parts.

1. The criteria. Five categories, of which security is mandatory and the other four are optional. Availability covers whether the service runs as promised, processing integrity whether data is processed correctly, confidentiality whether information meant to stay private does, and privacy how personal information is handled. Most companies start with security alone, because each added category widens what the auditor examines and what you have to keep records of.
2. The auditor. A US certified public accountant performs the audit and signs the report. That it takes the form of a financial audit rather than a certificate-issuing scheme defines its character. The output isn't a credential — it's a report of several dozen pages.
3. The report type. Two exist and the difference is large. Type 1 examines whether controls are in place at a point in time. Type 2 examines whether those controls were actually followed across three to twelve months. What buyers ask for is usually Type 2, because they want a record of adherence rather than a statement of readiness.

The preparation isn't buying impressive equipment. It's writing a security policy that states the rules, running access review — the periodic check of who can reach what — and keeping the records. What the auditor looks at is less the rules than the record of the rules running. State that permissions are reviewed quarterly and have no records from the last four quarters and that item doesn't pass, no matter how carefully the policy is written.

Cost and duration belong in the picture too. Type 2 has an observation window, so a first report takes six months to a year, and the audit fee alone runs around $23,000 a year. The preparer's hours are separate. Which makes when to start half the decision. Starting a year before the first enterprise deal is cheap; starting when a deal is already waiting means the deal waits.

Getting one isn't automatically the answer. Four options exist depending on the situation.

1. Building an answer library instead. Collect the questions arriving on security questionnaires and write standard answers. With five or six customers and no large enterprises among them, this finishes far cheaper. The limit is clear: some large buyers won't begin an evaluation without a report.
2. Getting ISO 27001, the international standard. European and Asian customers ask for that one first; US customers ask for SOC 2 first. Where your customers are decides the order, and guessing wrong costs a year rather than money.
3. Getting ISMS-P, the Korean scheme. If selling to Korean public institutions or financial firms is in the plan, that comes first, and in some cases it becomes a legal obligation.
4. Getting two or more. The criteria overlap substantially, so the second costs less effort than the first. Companies with customers on both sides end up holding both, and in that case it's better to collect the overlapping records in one place from the start.

"They've told us they won't start an evaluation without a Type 2."

The report type has become a condition of the deal.

"Let's take it with security only this year and add availability later."

Expanding the criteria in stages.

"We only have access review records for the last two quarters. That item won't pass as it stands."

Continuity of records deciding the outcome.

At Pagedeck, Grace started preparing after enterprise inquiries picked up. The trigger was one buyer asking for a SOC 2 report instead of a security questionnaire. After that deal stalled, the count showed three inquiries of similar size arriving per quarter.

The longest part of preparing wasn't equipment or tooling — it was records. Access permissions were in fact being reviewed, but no document recorded the results. So the work started with writing quarterly review results into one document, and the six-month observation window only opened after that record had accumulated four times. The audit, when it finally ran, was the short part.

A common belief is that holding SOC 2 makes a company secure. It passed an external audit, so security looks verified. But what the scheme confirms is whether the company followed the controls it defined for itself. Write loose controls, follow them, and the report issues. Incidents still happen after a report, and a report in hand is not a defense when one does. What the standard provides is not safety but a record of adherence, and the value of that record depends on what you wrote down as the thing to adhere to.

The other misreading is treating it as a certificate scheme. Like other certifications, passing should produce a mark to put on the website. In practice an audit report issues, and that report usually goes only to parties under a non-disclosure agreement, because it describes system architecture and controls in detail. So the website carries a sentence saying you hold one, and the report itself goes separately to buyers who ask — which means the sales team needs a process for sending it, not just a badge for the footer.