How SOC 2 Works
SOC 2 audits are conducted by independent, licensed CPA firms accredited by the American Institute of Certified Public Accountants (AICPA). The process begins with a readiness assessment, moves through evidence collection, and concludes with the auditor issuing a formal report that customers and prospects can review under NDA.
Define Scope and Criteria
Readiness Assessment
Implement and Document Controls
Observation Period (Type II Only)
Audit Fieldwork and Reporting
Annual Renewal
Why SOC 2 Matters
SOC 2 has moved from a nice-to-have to a commercial necessity across the SaaS and fintech landscape. Procurement teams at mid-market and enterprise companies now include SOC 2 Type II as a standard vendor qualification gate, alongside PCI compliance and GDPR attestations.
The business stakes are real. According to Vanta's 2024 State of Trust report, 88% of enterprise buyers require a SOC 2 report before sharing sensitive data with a vendor, and deals that stall on compliance documentation take an average of 3x longer to close. Separately, Drata's research found that companies with a current SOC 2 report close enterprise deals 3–5 weeks faster on average than those without, because security review cycles are compressed when audit evidence is already packaged.
For payment platforms specifically, the combination of SOC 2 and other frameworks is increasingly table stakes. A data breach affecting a vendor without a SOC 2 program creates immediate liability questions for the enterprise customer — SOC 2 shifts the burden of proof before an incident occurs rather than after.
Auditor Independence
SOC 2 vs. ISO 27001
Both SOC 2 and ISO 27001 are widely recognized information security frameworks, but they serve different markets and operate under different governance structures.
| Dimension | SOC 2 | ISO 27001 |
|---|---|---|
| Governing body | AICPA (U.S.) | ISO/IEC (international) |
| Output | Audit report (shared under NDA) | Certification (publicly assertable) |
| Scope | Flexible Trust Service Criteria | Full ISMS required |
| Primary market | North America | Europe, Asia, global enterprise |
| Renewal cycle | Annual report | 3-year certification + annual surveillance |
| Mandatory controls | Security (Common Criteria) only | All 93 Annex A controls scoped |
| Cost benchmark | $20K–$150K audit fee | $15K–$100K certification cost |
| Time to first report | 8–16 months (Type II) | 6–18 months |
For companies selling primarily into North American enterprise markets, SOC 2 Type II is usually the priority. Companies with European customers or global operations frequently pursue both frameworks — they share significant control overlap, so achieving one reduces the incremental effort for the other by 40–60%.
Types of SOC 2
Understanding the two report types prevents a common mistake where teams invest months of effort in a Type I report only to have enterprise buyers ask for Type II.
SOC 2 Type I examines whether a company's security controls are designed appropriately as of a specific date. It is a point-in-time snapshot. Type I is useful for early-stage companies that need to demonstrate baseline security posture to close an initial enterprise deal while a longer observation period is underway.
SOC 2 Type II examines whether those controls operated effectively over a defined period — typically 6 to 12 months. This is the report that enterprise procurement teams, security teams, and regulated industries require. It is significantly more demanding to achieve and significantly more credible as a trust signal.
Bridge Letters
Best Practices
For Merchants
When evaluating payment vendors or SaaS partners, treat SOC 2 reports as baseline procurement hygiene rather than a differentiator. Request the full report — not just a summary — and review the auditor's exceptions section carefully. A report with zero exceptions is ideal; a report with exceptions that have been remediated and documented is acceptable. An unqualified opinion from a reputable CPA firm matters more than a clean-looking summary page. Also confirm the report observation period is current: a report more than 12 months old provides limited assurance about today's controls.
For Developers
Build SOC 2 into your development lifecycle from day one rather than retrofitting controls onto a mature codebase. Use infrastructure-as-code and enforce it — auditors love configuration that is provably consistent. Instrument your systems with centralized logging from the start; log aggregation is required evidence for multiple Common Criteria controls and costs far more to retrofit than to implement early. Use a compliance automation platform (Vanta, Drata, Secureframe, Tugboat Logic) to continuously collect evidence rather than scrambling at audit time. Automate access reviews on a quarterly cadence — manual access review processes consistently generate audit findings.
Common Mistakes
Several recurring errors slow SOC 2 programs or generate audit findings that damage customer trust.
Treating SOC 2 as a one-time project. The audit cycle is annual. Organizations that treat compliance as a project rather than a continuous program find themselves scrambling every 10 months, generating findings, and losing the institutional knowledge needed to sustain controls.
Scoping too broadly. Including every system, product, and team in scope dramatically increases cost and audit risk. Define a tight, defensible scope boundary that covers the systems customers actually care about. Tighten scope on the first audit; expand it on renewals.
Ignoring vendor management. SOC 2 requires you to assess the security posture of your own sub-processors and vendors. Organizations that overlook vendor risk assessments receive findings even when their own controls are clean.
Poor evidence collection habits. Auditors need contemporaneous evidence — logs, screenshots, approval records — not retrospective documentation created the week before fieldwork. Teams that do not collect evidence continuously during the observation period cannot reconstruct it accurately.
Conflating SOC 2 with encryption alone. Security-focused teams sometimes over-invest in encryption while under-investing in access control, change management, and incident response. SOC 2 Common Criteria covers all of these areas; gaps in any one area generate findings.