SOC 2 is a report from an independent CPA firm on controls at a service organization, not a certificate. A CTO should decide which systems and criteria are in scope, whether a point in time or a period report fits the customer ask, and who owns evidence. Be careful with promises of speed.
What is a SOC 2 report?
The AICPA, which sets the professional standards for SOC engagements, describes its SOC suite as giving users assurance reports to help assess risks of outsourcing services. A licensed CPA firm performs the examination and issues the report. That is why the auditor's credentials matter as much as your controls.
The AICPA has been public about concerns in the market. Its SOC page carries a notice about allegations of questionable practices at a compliance vendor, a reminder that firms should be licensed and enrolled in peer review, and 2026 articles on the risks of quick-turn SOC engagements and on business arrangements between CPA firms and SOC tool providers. Read those before you sign with anyone.
What does a CTO decide?
Scope. Which product, environments and teams, and which of the trust criteria matter to your customers. Security is the baseline for most. Add availability, confidentiality or others only where customers need them, because each adds evidence work.
Report type. A report as of one date answers a different question than one covering a period. Customers who ask for a period report want to see controls operating over time. Ask what your customers actually require before you pick.
Ownership. Name an executive owner, a day to day coordinator, and an owner for each control area. Audits slow down when nobody can say who approves access reviews.
Tools. Automation can collect evidence, but the AICPA is explicit that SOC services should be thoroughly evaluated by service organizations and CPA firms. Treat a tool as help for evidence, not as the auditor.
How do you check an auditor?
Ask for the firm's license status and peer review enrollment. Ask who actually performs the work and how much time they spend. Ask for sample report structure without confidential details. Be skeptical of fixed price promises with unrealistically short timelines for a period report.
A constructed example
A startup's largest prospect asks for a SOC 2 report in sixty days. The CTO reads the AICPA notices, asks two firms about license and peer review, and finds that one offers a two week period report. A control operating period of two weeks gives little evidence, and a sophisticated customer may notice. The CTO instead agrees with the customer on a point in time report now, a period report later, and a signed commitment date. The deal proceeds with an honest plan.
What to do
- Ask your customers which report type and criteria they require, in writing.
- Define the in-scope systems, and shrink scope where it is cheap to do so.
- Name an executive owner, a coordinator and control owners.
- Check each candidate firm's license and peer review enrollment on the relevant public registers.
- Read the AICPA's SOC page notices and articles on fast SOC engagements.
- Run a readiness review so surprises happen before the audit window.
- Decide how you will keep controls running after the report is issued.
Safeguard offers compliance automation for evidence on software and vulnerability controls. It does not issue SOC 2 reports, and a SOC 2 report comes only from a CPA firm.
Quick check
Is SOC 2 a certification?
No. It is an attestation report issued by an independent CPA firm after an examination.
What should you check about an auditor?
That the firm is licensed and enrolled in peer review, and who actually performs the work.
Sources
Last reviewed: 18 October 2026.
