What Is SOC 2?
Key takeaways
- SOC 2 is an attestation, not a certification, so nobody issues a SOC 2 certificate, and a customer is asking for a report under your own name rather than a badge.
- The five trust services criteria are security, availability, confidentiality, processing integrity and privacy, and you can be in scope for security alone, which is the common choice for an Indian SaaS vendor.
- A Type I report says the controls were designed properly on one day, and a Type II says they ran effectively over a period, and enterprise customers usually want the Type II.
- Most SOC 2 engagements include an optional penetration test, and in a mature assessment the test is the fastest way to close the real findings that the control testing exposes.
- In India the demand is enterprise and mid-market buyers running vendor risk programmes, and the practical prep work is the same documentation a CERT-In or ISO 27001 audit would need, so the three should be planned together.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is SOC 2, and how is it different from ISO 27001?
SOC 2 is an attestation report from an independent licensed public accounting firm against the AICPA's Trust Services Criteria, covering security and optionally availability, confidentiality, processing integrity and privacy. ISO 27001 is a certification of an information security management system against the ISO standard, issued by an accredited certification body. The practical differences: SOC 2 is an opinion on whether your controls operated effectively over a stated period, and it is scoped to a service and a system, while ISO 27001 is scoped to the organisation and its ISMS. SOC 2 is what an enterprise customer's vendor risk programme asks for; ISO 27001 is what a public sector tender and many procurement policies ask for.
What is the difference between a Type I and a Type II report?
A Type I report covers the design of your controls at a single point in time, usually over a few weeks, and it answers whether the controls, if run by a competent person, would achieve the stated objectives. A Type II report covers the operating effectiveness of those controls over a stated period, typically three to twelve months, and it answers whether they actually ran. Enterprise customers in India and globally almost always want the Type II, because the question they need answered is whether your controls work in practice, not only whether they are written down. The practical consequence for a first-time vendor is a minimum observation period that has to be planned for, not compressed.
What are the trust services criteria, and which do you need?
Five criteria: security, which is the common or mandatory baseline covering the control environment, access control, system operations, change management, and risk mitigation; availability, which is the commitment about uptime and capacity; confidentiality, which covers data protected from unauthorised access; processing integrity, which covers whether processing is complete, accurate and timely; and privacy, which covers the personal information processed and the commitments made about it. Most Indian SaaS and managed service vendors start with security alone and add availability when the contract has an uptime commitment. Choose the criteria against the contract you have and the questions your buyers actually ask, because each additional criterion adds evidence collection and audit time.
What do you have to do to get SOC 2 ready in India?
Build the control set, run it for the observation period, and keep the evidence. In practice that means documented policies, an asset inventory, joiner-mover-leaver processes, access reviews, change management with ticket records, secure configuration baselines, log retention and monitoring, vendor management with clauses, incident response with tested procedures, and a risk assessment. Two things usually cost the most time: access reviews and change management, because both are easy to skip under delivery pressure and both are sampled hard. And include a penetration test in the engagement, because it finds the real weaknesses quickly and the findings feed straight into the remediation list the auditor samples.
| Criterion | What it covers | Evidence an auditor samples |
|---|---|---|
| Security | Control environment, access control, operations, change management and risk mitigation | Access reviews, change tickets, joiner-mover-leaver records, risk register |
| Availability | Uptime, capacity and recovery commitments | Incident logs, capacity monitoring, backup restore tests, availability calculations |
| Confidentiality | Protection of information not covered by privacy | Encryption configuration, key management, access restrictions on sensitive data |
| Processing integrity | Completeness, accuracy and timeliness of processing | Job reconciliations, exception queues, error handling and correction records |
| Privacy | Collection, retention, disclosure and deletion of personal information | Privacy notice, consent records, retention schedule, deletion evidence, data subject requests |
What are the frequently asked questions?
Get a straight answer on this
Send us the security questionnaire your largest prospect sent, and we will return a SOC 2 readiness plan with the evidence you will need to produce.
Send us the details See pricing