SOC 2 for a first security hire: what you own and what you do not

SOC 2 is a report written by a licensed CPA firm about your controls, not a certificate you buy. As a first security hire you own the control program and the evidence. The auditor owns the opinion. Your early decisions are scope, report type, the audit window and who the auditor is, and each is hard to undo.

What is a SOC 2 report?

The AICPA sets the professional standards for SOC engagements, and its page describes SOC reports as assurance for users assessing risks of outsourcing services. A SOC 2 report covers controls at a service organization against the Trust Services Criteria. Security is always included. Availability, processing integrity, confidentiality and privacy are optional categories you choose based on your promises to customers.

A Type I report describes whether controls are designed appropriately at a point in time. A Type II report adds testing of whether they operated effectively over a period. Buyers usually ask for Type II, but many companies start with Type I to get something in hand.

Why does the choice of auditor matter?

The AICPA has been publicly cautious about the market. Its site carries pieces from 2026 titled "Promises of fast and easy threaten SOC credibility" and on the risks of quick-turn SOC engagements, and says it is looking into allegations about a compliance vendor. It also stresses that service organizations and CPA firms should thoroughly evaluate SOC services.

For you that means checking the audit firm is a licensed CPA firm, enrolled in peer review, and independent from the tooling vendor that sold you the platform. A report from a doubtful source may not satisfy a careful buyer, and the money is wasted.

What is your role versus the auditor's?

You build and run the controls: access management, change control, vulnerability management, logging, vendor review, incident response, onboarding and offboarding, and security training. You assemble evidence. You write, or help write, the system description that the report includes.

The auditor tests and forms an opinion. You do not negotiate the opinion. You can influence scope and clear up misunderstandings.

What should you decide first?

1. Categories. Security alone is the lighter starting point. Add others only if you promise them.
2. Scope. Which product and which systems. Match what customers buy.
3. Type and window. If Type II, choose the observation period. Longer windows give stronger assurance but more time for controls to fail.
4. Tooling. Automation helps with evidence collection, but it does not make an audit shorter by itself, and it does not replace judgment.
5. Owner for each control. An unowned control fails first.

What are the common first-year mistakes?

Writing policies nobody follows, since the auditor tests operation. Letting a control lapse mid-window, for example skipping a quarterly access review. Putting too many systems in scope. Promising a report date to customers before the auditor has agreed a timeline.

Also avoid telling customers you are "SOC 2 compliant" before a report exists. Say what is true: for example, an audit is underway, with the scope and target period.

How to check or apply this

1. Ask which customers require SOC 2 and which type.
2. Choose categories and scope in writing with leadership.
3. Verify the auditor's licence and peer review status.
4. Run a readiness review and fix gaps before the window opens.
5. Assign owners and a calendar for recurring controls.
6. Collect evidence monthly instead of at the end.

Quick check

Sources

• AICPA SOC suite of services

Last reviewed: 18 October 2026.