SOC 2 report guide for Indian service providers selling to US and global customers

A SOC 2 report is an independent CPA firm's report on the controls a service organisation runs over the systems and data it handles for customers. It is issued under AICPA attestation standards, measured against the AICPA Trust Services Criteria, and requested by customers, mostly US and global enterprises, during procurement. For an Indian IT, SaaS, BPO or managed-service provider, it is usually the document that decides whether a security review ends or drags on.

This is the deeper guide. If you are still deciding between SOC 2 and ISO 27001, read SOC 2 or ISO 27001: which one does your customer actually want? first, then come back here.

What does a SOC 2 report actually contain?

SOC stands for system and organization controls, the AICPA's umbrella name for a suite of services CPAs may provide. A SOC 2 engagement is an assertion-based examination: your management describes the system and asserts that the controls meet the criteria, and the CPA firm gives an opinion on that. The AICPA's own illustrative report is built from four parts:

1. 1The service auditor's report, which is the CPA firm's opinion
2. 2Management's assertion, signed by your management
3. 3The description of the system, prepared against the AICPA's 2018 description criteria (DC 200, with implementation guidance revised in 2022)
4. 4Tests of controls and results, in a Type 2 report

DC 200 does not prescribe a layout, so descriptions differ between providers. That is why two reports can look very different and still both be valid.

Which Trust Services Criteria are mandatory?

The criteria are the 2017 Trust Services Criteria, with points of focus revised in 2022. Points of focus are guidance under each criterion, not extra criteria. There are five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy.

Security, also called the Common Criteria, is always in scope. The other four are your choice. The test is simple: add a category only if you make promises to customers that it would cover.

Adding categories adds controls to test and evidence to produce. Buyers do not reward a long scope that the system does not need. Customers who are a regulated entity in India or the EU may also run a privacy review of their own, which the DPDP Act checklist covers separately from SOC 2.

Type 1 or Type 2, and how long is the observation period?

A Type 1 report covers the design of controls at one date. A Type 2 report covers design and also whether the controls operated effectively across a period, with the CPA firm's test results listed.

Why most buyers read Type 2 more closely is easy to see. A Type 1 report says a control exists. A Type 2 report says it ran, every time it was meant to, and shows what the auditor tried to break.

The length of the Type 2 period is agreed between you and the CPA firm. The AICPA pages we could open do not state a fixed minimum, so decide it with the firm and with the customers who are waiting for the report. Three practical points:

• Controls must already be running when the period starts. A control introduced halfway through has no evidence for the earlier part of the period, and the CPA firm will want to discuss how that is reported.
• A short first period is a legitimate choice. Many providers take a Type 1 report to unblock a deal and a longer Type 2 afterwards.
• Gaps between periods matter. If your last report ended some months ago, customers will ask what happened since. A bridge letter from management is the usual answer, but it is your statement, not an audit opinion.

What does the CPA firm do, and how do you choose one?

The CPA firm is independent of you and gives the opinion. It does not build your controls. In practice it agrees the scope with you, reviews your description and assertion, designs tests, performs fieldwork, reports exceptions and issues the report.

Three checks before you sign an engagement letter:

• Licence and standing. The AICPA sets the professional standards for SOC engagements and says auditors who do not follow them, are outside peer review or are unlicensed may face AICPA action. Ask for the firm's licence and peer review status.
• SOC 2 volume. Ask how many SOC 2 reports the firm issued last year, for which kinds of provider.
• Fieldwork model. Ask how the firm will test people, systems and sites in India, and how evidence is shared.

Readiness work, such as a gap assessment, is separate from the examination. Whoever helps you prepare should not be the one marking your work.

How do customers use the report in a vendor review?

The AICPA describes the need plainly: customers and business partners want information about the design, operation and effectiveness of controls at the organisation they outsource to. A reviewer at a bank, insurer or software company will usually read in this order:

Expect a follow-up questionnaire as well. The report answers most of it, and what it does not answer, such as your handling of the customer's own data, becomes the questionnaire. The third-party risk assessment checklist shows what buyers ask for beyond the report.

What do auditors sample?

The CPA firm tests controls by inquiry, observation, inspection of records and reperformance. For controls that run many times, it picks samples from across the period. How many items it picks is the firm's judgement, so ask during planning, not during fieldwork.

The evidence reviewers ask for repeatedly:

• Joiners and leavers: the request, the approval, and the date access was granted or removed
• Access reviews: the review itself, who signed off, and what was changed afterwards
• Changes: the ticket, testing, approval and release record for a sample of changes
• Incidents and alerts: detection, triage, resolution and review for sampled events
• Vulnerability management: scan results and the closure of sampled findings
• Vendors: the review you performed, and the SOC report of the vendors you rely on
• Policies: the approved version and staff acknowledgements
• Risk assessment: the assessment, who reviewed it and when

A common pattern in Type 2 exceptions is that the work was done, but late, or without a record, or by someone who was not the named owner. See the audit readiness checklist for the broader habits.

SOC 2 or SOC 3, and who may read the report?

A SOC 3 report covers the same five categories but with less detail, and the AICPA describes it as general use that can be freely distributed. A SOC 2 report carries more detail and is not general use. For a sales team, the practical rule is to publish the SOC 3 where one exists, and release the SOC 2 under a confidentiality agreement.

A checklist before you engage a CPA firm

How this runs as owned work in Netra

A SOC 2 period fails or passes on routine. In Netra, SOC 2 is loaded as requirements, tasks and policies. Each recurring control is a task with an owner and a due date, evidence is attached once where the work is done, and status is derived from completed work and evidence, not typed in. The Audit Centre holds requests and findings, so the CPA firm's samples come from a record that was built through the period.

Netra helps run and evidence the work. The report is issued by your CPA firm after its own examination. The SOC 2 page shows how the criteria, tasks and evidence connect.

This article is for general information. Your CPA firm decides what is sufficient for your scope and period.