SOC 1
Controls that impact your clients’ financial statements (SSAE 18 or ISAE 3402).
SOC 1 · SOC 2 · SOC 3
SOC reports: prove that your controls work
We prepare your organization to obtain a clean SOC 2 or ISAE 3402 report, the one your clients in the United States and Europe ask for.
What is a SOC report?
Trust verified by an independent auditor
A SOC (System and Organization Controls) report is an independent auditor’s opinion on the controls of an organization that provides services to others.
It is issued under AICPA standards (SSAE 18) or their international equivalents (ISAE 3402 and ISAE 3000), and only a licensed audit firm can sign it.
It is a common requirement for SaaS companies, fintechs, data centers and providers that sell to enterprise clients, especially in the United States.
Report types
Three reports, three audiences
SOC 2
Security, availability, processing integrity, confidentiality and privacy. Restricted to clients and auditors.
SOC 3
A general-use summary of the SOC 2, designed to publish on your website.
Phases
How we prepare you
- 1Scope: system, services and applicable trust services criteria.
- 2Readiness assessment and gap analysis against the criteria.
- 3Design and implementation of controls, policies and evidence, reusing ISO 27001 if you already have it.
- 4Internal pre-audit and dry run with your team.
- 5Support throughout the audit firm’s fieldwork until the report is issued.
- 6Control monitoring throughout the Type II observation period.
Type I and Type II
A snapshot or a movie
Type I
Evaluates the design of controls at a specific date. A good first step.
Type II
Evaluates the operating effectiveness of controls over a period, usually 3 to 12 months. It is the one clients value most.
Cloud Legion prepares and supports you; an independent audit firm issues the report. We work with the firm you choose or help you choose one.
Why a SOC report
Speed up your enterprise sales
Fewer questionnaires
You answer with a report instead of hundreds of security questions.
Shorter sales cycles
You pass large clients’ vendor assessments.
You reuse ISO 27001
Most controls are shared, so you avoid duplicate work.
Continuous improvement
Type II requires keeping controls running all year.
Who it applies to
Organizations that provide services to others
- SaaS platforms and cloud services
- Fintechs and payment processors
- Data centers and hosting
- BPO and outsourced services
- Software for US clients
- Payroll and HR services
FAQ
What clients ask us most
What is a SOC 2 report?
It is an attestation report issued by an independent auditor on a service organization’s controls over security, availability, processing integrity, confidentiality and privacy.
Who issues the report?
A licensed independent audit firm (a CPA firm under AICPA standards, or an auditor under ISAE standards). Cloud Legion prepares the organization and supports it during the audit.
SOC 2 or ISO 27001?
ISO 27001 certifies a management system with global recognition; SOC 2 is a report in high demand in the United States. They share most controls, which is why many companies have both.
How long does it take?
It depends on where you start. Type I readiness usually takes two to four months; Type II adds an observation period of 3 to 12 months.
Has a client asked you for a SOC 2?
We tell you how far you are and how to get to the report as fast as possible.