What is SOC 2?
You sell software. An enterprise customer asks: “Do you have SOC 2?” SOC 2 is the American standard that proves you handle customer data securely. It was developed by the AICPA (American Institute of CPAs) .
You do not get a certificate, but a report. In the Netherlands it is also called a SOC 2-verklaring (SOC 2 assurance report). An independent accountant tests your security controls and states: “This organisation has the right measures in place.” You share that report with customers. NOREA (Dutch IT auditors’ association) can also perform this under ISAE 3000 . Read more about SOC 2 in the Dutch context.
SOC stands for Service Organization Control. SOC 1 covers financial processes, SOC 2 covers IT security (this article), and SOC 3 is a public summary.
SOC 2 in brief
| What is it? | Attestation report on IT security |
| For whom? | SaaS, cloud providers, IT service providers |
| Mandatory? | No, but often required by enterprise customers |
| Validity | 12 months (renewed annually) |
| Costs | €40,000 - €100,000+ in the first year |
| Lead time | Type I: 3-6 months, Type II: 6-15 months |
The core: 5 criteria
SOC 2 tests you against the Trust Services Criteria:
| Criterion | Mandatory? | Focus |
|---|---|---|
| Security | Yes | Protection against unauthorised access |
| Availability | No | System available when needed |
| Processing Integrity | No | Data is processed correctly |
| Confidentiality | No | Confidential information is protected |
| Privacy | No | Personal data is handled correctly |
You choose which criteria are relevant. Security is always mandatory.
Type II takes at least 9 months. Sales teams often promise “we have SOC 2 in 3 months.” That is impossible. Start in time.
Next steps
SaaS, fintech, cloud provider? Check whether SOC 2 fits you.
Who is it for?A snapshot or evidence over time? Which one do you choose?
Type I vs Type IIFrom zero to report in 12 steps.
Step-by-step planWhat does it really cost? With indications by company size.
Costs and timelineThe 5 pillars explained.
Trust Services CriteriaAmerica vs Europe. Which one do you choose?
SOC 2 vs ISO 27001What does a Type II report look like? With a filled-in example.
SOC 2 report: exampleWhat can you do yourself, and what must an external auditor do?
Internal auditor and SOC 2Who may see it, and how do you share it safely?
Sharing the report with customersMay a Dutch RE-auditor issue the SOC 2 report?
RE-auditor (Register EDP-auditor) and SOC 2Do American customers accept a Dutch SOC 2 report?
American customersMore pages
- The audit process: what does the auditor do?
- Controls: what do you need to implement?
- Collecting evidence: what auditors want to see per criterion
- Readiness assessment: ready for the audit or not?
- Compliance tooling: Vanta, Drata, Secureframe and Sprinto compared
- Bridge letter: closing the gap between two reports
- For startups and scale-ups: when to start and how to control costs
- SOC 2 vs SOC 1: which SOC report do you need?
- ISAE 3402 vs SOC 2: which assurance standard fits?
- SOC 2 in the Netherlands: the Dutch context
- For SaaS companies: specific tips
- For cloud providers: data centres and hosting
- Developments in 2026: trends and new expectations
- Frequently asked questions: all the answers
Sources
- AICPA Trust Services Criteria : official criteria
- NOREA : Dutch IT auditors
- IFAC ISAE 3000 : international audit standard