Question 1

My client requires a SOC 2 report. What does that mean?

Accepted Answer

Your client would like to receive independent evidence that your organisation has implemented appropriate controls to protect their data and, in the case of a Type 2 report, that these controls operated effectively over a defined period. A SOC 2 report is often requested as part of tenders, due diligence or supplier assessments.

Question 2

Does every company need to have all five Trust Services Criteria audited?

Accepted Answer

No. The Security criterion is mandatory. The additional criteria &mdash; Availability, Processing Integrity, Confidentiality and Privacy &mdash; are selected depending on your services, the data processed and your clients&rsquo; requirements.

Question 3

Type 1 or Type 2?

Accepted Answer

A Type 1 report assesses the suitability of controls at a specific point in time. A Type 2 report additionally provides evidence of their operating effectiveness over an audit period and is preferred by many international clients.

Question 4

Can I combine SOC 2 with ISO 27001?

Accepted Answer

Yes. An existing ISO 27001 certification often facilitates preparation for a SOC 2 audit, but does not replace it. Many controls overlap, allowing documentation and evidence to be used multiple times.

Question 5

Can SOC 2 be combined with BSI C5?

Accepted Answer

Yes. Since many requirements overlap, both audits can often be based on a common control framework. This reduces project effort and improves the consistency of evidence. In practice, this means that many cloud providers need both forms of evidence. With coordinated planning, overlaps in the control framework can be used efficiently.

Criterion	Objective
Security	Protection of systems against unauthorised access
Availability	Availability of systems in accordance with commitments
Processing Integrity	Complete and accurate processing
Confidentiality	Protection of confidential information
Privacy	Protection of personal data

SOC 2 – The international standard for trust in digital services

Overview

To whom is the standard relevant?

What is audited?

Scope of services

Benefits

FAQ

Your tailor-made solution.