SOC 2 Compliance for UK Companies: What It Is and How to Prepare

SOC 2 compliance means an independent, licensed CPA firm has examined your controls against the AICPA’s Trust Services Criteria and issued a SOC 2 report. It is an attestation, not a certificate: there is no pass mark and no logo, just a report and the auditor’s opinion that customers read in detail. Security is always in scope, and you choose whether to add availability, processing integrity, confidentiality or privacy.

No UK law requires SOC 2. UK companies pursue it because customers ask for it, most often US enterprises buying SaaS, cloud or data services. This guide explains what SOC 2 involves, how long it takes and how to prepare.

Sovereign Secure does not issue SOC 2 reports; only licensed CPA firms can. We provide the penetration testing and vulnerability scanning evidence that SOC 2 examinations rely on.

What is SOC 2 compliance?

Being SOC 2 compliant (sometimes written SOC2 compliant) means holding a current SOC 2 report on your controls. SOC 2 itself is one of the System and Organization Controls (SOC) reports defined by the AICPA, the American Institute of Certified Public Accountants. A CPA firm examines how a service organisation protects the systems and data it handles for customers, then reports on it. SOC 2 is one of three main SOC reports; the next section sets out how they differ.

A SOC 2 report contains the CPA firm’s opinion, management’s written assertion, a description of the system in scope, and the controls with the criteria they meet. A Type 2 report also lists the auditor’s tests and any exceptions found.

SOC 1 vs SOC 2 vs SOC 3: what is the difference?

SOC 1 reports on controls that affect your customers’ financial reporting, SOC 2 reports in detail on security and the other Trust Services Criteria, and SOC 3 is a short, public version of a SOC 2. Most technology suppliers are asked for SOC 2.

What are the SOC 2 requirements?

The SOC 2 requirements are the Trust Services Criteria: the AICPA’s 2017 criteria, with points of focus revised in 2022. They are grouped into five categories. Security, also called the Common Criteria, is mandatory in every SOC 2 report; the other four are added when they matter to your customers.

The Common Criteria are numbered CC1 to CC9:

SOC 2 does not prescribe specific controls. You design controls that meet each criterion, and the CPA firm tests whether they do. The points of focus are guidance, not a mandatory checklist.

SOC 2 checklist and controls list

Because SOC 2 sets criteria rather than controls, there is no official SOC 2 controls list. This SOC 2 checklist shows the controls CPA firms most often test, mapped to the Trust Services Criteria they usually support. Your own list will depend on your system and the categories in scope.

A1.2 and A1.3 are Availability criteria, so they apply only when Availability is in scope. For the vendor management row (CC9.2), our vendor risk assessment guide has a supplier questionnaire you can adapt, and our guide to third-party risk management covers the programme around it.

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 report assesses whether your controls are suitably designed at a single point in time. A Type 2 report also tests whether they operated effectively over an observation period, so it carries more weight, and most enterprise customers ask for it. Many companies start with a Type 1 to unblock a deal, then move to Type 2. Our guide to SOC 2 Type 1 vs Type 2 explains how to choose and how long the observation period should be.

Do UK companies need SOC 2?

UK companies need SOC 2 only when their customers ask for it. It is a commercial requirement, not a legal one. It comes up most for SaaS companies and service providers selling into the US, where SOC 2 is the default answer to a supplier security review.

UK and European buyers more often ask for ISO 27001, which is a certification against an international standard. The two overlap heavily, and many companies hold both. Our comparison of ISO 27001 vs SOC 2 explains when one can stand in for the other.

How do you prepare for SOC 2 certification?

Strictly, there is no SOC 2 certification. “SOC 2 certification” and “SOC 2 certified” are everyday shorthand for holding a SOC 2 report with an unqualified opinion, and preparing for one is called readiness. Readiness usually follows these steps:

1. Define the scope. Decide which services, infrastructure, software, people and data the report will cover, and which Trust Services Criteria categories to include.
2. Run a gap assessment. Compare your current controls with the criteria. If you already run an ISO 27001 ISMS, much of the ground is the same, and an ISO 27001 gap analysis covers risk assessment, access control and supplier management that SOC 2 also tests.
3. Close the gaps. Write or update policies and put controls in place, such as MFA, logging, change approval, access reviews, vendor management and security awareness training.
4. Organise evidence. Decide how you will show each control working: tickets, logs, screenshots, reports and sign-offs. Compliance automation platforms can help but are optional.
5. Test your security. Commission a penetration test of the in-scope system and set up regular vulnerability scanning, then fix and retest findings.
6. Choose a CPA firm. Agree scope, report type and dates.
7. Examination. The CPA firm tests your controls and issues the report, with your system description and management’s assertion.

What happens in a SOC 2 audit?

A SOC 2 audit, properly called an examination, is carried out by a licensed CPA firm, which tests your controls and then attests to them in a report. It runs in stages:

1. Planning. The CPA firm agrees the system boundary, the Trust Services Criteria in scope, the report type and, for a Type 2, the observation period.
2. System description and assertion. You write a description of the system, and management signs an assertion about it and about the controls.
3. Fieldwork. The auditors interview staff, inspect configurations and sample evidence such as access reviews, change approvals, incident tickets and penetration test reports. For a Type 2 they sample across the whole observation period.
4. Exceptions. Any control that did not work as described is recorded as an exception, with your response.
5. Report. The CPA firm issues its opinion with the system description, your assertion and, for a Type 2, its tests and results.

Sovereign Secure is not a CPA firm and does not issue SOC 2 reports. We provide the penetration testing and vulnerability scanning evidence used during readiness and sampled in the examination.

How long does SOC 2 take?

From a standing start, a first Type 1 report is usually a few months away, and a first Type 2 usually takes from around six months to a year or more because of the observation period. Your timescale is driven by your gaps and that period far more than by the CPA firm’s fieldwork.

Plan the penetration test so it falls inside the period the report covers, and budget for an annual cycle: once you have a Type 2, customers will expect a new one each year.

How much does SOC 2 cost?

There is no fixed price. SOC 2 cost has three parts: the CPA firm’s examination fee, the readiness work to close your gaps, and the testing and tools that produce evidence. These drivers move all three:

For the testing element, our penetration testing cost guide explains what drives the price of a test.

Does SOC 2 require penetration testing?

Not explicitly, but in practice CPA firms and customers expect one. The points of focus for CC4.1 list penetration testing as one way to evaluate controls, and those for CC7.1 cover vulnerability scanning, so a recent test of the in-scope system, with findings fixed and retested, is the evidence most companies use. Our page on SOC 2 penetration testing covers the scope CPA firms accept, timing within the observation period and report format.

Who can issue a SOC 2 report?

Only a licensed CPA firm can issue a SOC 2 report, working under the AICPA’s attestation standards. A UK company can use a US CPA firm working remotely, or a UK accounting firm through a US-licensed CPA practice in its network. When choosing one, ask:

Why Sovereign Secure

We are not a CPA firm and we do not issue SOC 2 reports. What we provide is evidence:

• Penetration testing of web applications, APIs, cloud environments, networks and mobile apps, scoped to your SOC 2 system boundary and timed for your observation period, plus vulnerability scanning.
• ISO 27001 certified, with ISO 27001 consultancy for companies that need both frameworks. Certification audits are carried out by our partner certification body, MQA International.
• Payments expertise for SaaS platforms that handle card data: we are a PCI SSC Qualified Security Assessor (QSA) company and a GEAR member for 2026 to 2028.
• A UK company since 2012, headquartered in Accrington, Lancashire, with an office in Los Angeles as well as Singapore, Dubai and Dhaka.

Book your SOC 2 penetration test

Tell us your observation period, the applications and cloud accounts in scope, and any CPA firm requirements. We will scope a test that lands inside your window. Request a penetration testing quote or call +44 161 523 5276.