SOC 2 developments 2026

SOC 2 keeps evolving. The Trust Services Criteria stay the same, but how auditors interpret them and what they expect changes over time. This article covers the main trends and developments that affect your SOC 2 audit in 2026. For the official position, see the AICPA .

1. AI governance as a new focus area

What is happening

Organisations use more and more AI systems: LLMs, machine learning models and automated decision-making. Auditors now ask: “How do you manage AI security and ethics?”

This is not explicitly part of the Trust Services Criteria, but it falls under Security (AI systems must be secure) and Processing Integrity (AI outputs must be accurate and fair).

What auditors ask

AI inventory: “Which AI systems do you use? For what purposes?”

• ChatGPT or Claude for customer support
• ML models for fraud detection
• Automated content moderation
• Recommendation engines

Data governance: “Which data does your AI use? Is customer data involved?”

• Training data: where does it come from, and is it biased?
• Inference data: what is processed in real time?
• Data retention: how long do you keep AI inputs and outputs?

Model security: “How do you secure your AI models?”

• Model access controls (not everyone can download model weights)
• Prompt injection prevention
• Output validation (sanity checks on AI responses)
• Monitoring for misuse

Bias and fairness: “How do you make sure your AI is fair?”

• Bias testing (with diverse datasets)
• Fairness metrics tracked
• Human oversight (humans in the loop)
• Appeal mechanism (users can challenge AI decisions)

Practical implementation

AI usage policy: Document which AI you use, for what, and how you secure it.

AI risk assessment: For each AI system: what are the risks (bias, hallucination, data leakage), and how do you reduce them?

Monitoring: Log AI usage, track errors and failures, and watch for anomalies.

Evidence:

• AI inventory spreadsheet
• Risk assessments per AI system
• Monitoring dashboards
• Incident reports (AI-related issues)

This is cutting edge. Not all auditors ask about it in depth yet, but 2026 is the year it becomes mainstream.

2. Continuous compliance: from yearly to real time

The old way

Audit once a year. Three months before the audit: panic mode, clean everything up, gather evidence, update policies. Audit done: relax for nine months, then repeat the cycle.

The new way

Continuous compliance: Your compliance system runs 24/7. Real-time monitoring, automated checks and continuous evidence collection. The audit is no longer an event but continuous validation.

What this means

Compliance platforms become a must-have: Tools such as Vanta, Drata and Secureframe monitor your controls continuously. Daily screenshots, automated tests and continuous integration with your infrastructure.

Real-time alerts: MFA disabled? Alert within 5 minutes. A user gets production access without approval? Alert. A vulnerability is not patched within the SLA? Alert.

Automated remediation: Some controls fix themselves. A user account is not disabled at offboarding? The system disables it automatically after 24 hours.

Auditor expectation: “Show me your continuous monitoring dashboard.” You show the real-time status of all controls, historical trends and automated alerts.

Pros and cons

Advantage:

• The audit is less stressful (no last-minute panic)
• You always know your compliance status
• Issues are detected and fixed straight away

Disadvantage:

• Initial setup is complex and expensive (tooling €10,000-€25,000 per year)
• It requires a cultural shift (compliance is daily work, not a yearly event)
• Alert fatigue (too many alerts and people ignore them)

Trend: In 2026, continuous compliance is expected at medium-sized to large organisations. Small startups still get a grace period.

3. Vendor risk management: stricter requirements

What is happening

30% of data breaches in 2024 came through third-party vendors. Auditors have become much stricter about vendor management.

New expectations

Vendor inventory: Not just a list of vendors, but detailed:

• Which data does each vendor have access to?
• Which systems can they reach?
• What is their risk level (critical, high, medium or low)?
• Do they have SOC 2 or ISO 27001?

Due diligence for new vendors: Before you engage a new vendor:

• Complete a security questionnaire
• Review their SOC 2 or ISO 27001 report
• Review the contract (security clauses, DPAs)
• Carry out a risk assessment (what if they suffer a breach?)
• Get approval from the security team

Continuous monitoring: You check not only at onboarding, but on an ongoing basis:

• Quarterly: check that the vendor’s SOC 2 is still valid
• Monthly: monitor the vendor for breaches (via news and security feeds)
• Annually: hold a vendor review meeting and reassess the risk

Sub-processor transparency (GDPR): If a vendor uses sub-processors, you must know them and be able to assess them too.

Practical impact

More work: At larger companies, vendor management has become a full-time job, often with a dedicated vendor risk manager.

Vendor onboarding takes longer: From “sign the contract and start using it” to “six weeks of due diligence, security review and an approval process.”

Vendor rejections: If a vendor does not have SOC 2 (and you do), you no longer accept them. The security bar is higher.

Evidence the auditor wants to see:

• Vendor register (spreadsheet: vendor, data access, SOC 2 status, last review date)
• Sample vendor assessments (3 to 5 vendors)
• Vendor contracts with security clauses
• SOC 2 reports of critical vendors
• Notes from quarterly vendor review meetings

4. Wider scope: more criteria per audit

What is happening

In the past, most companies chose Security only. Now Security plus Availability is the minimum, often with Confidentiality as well.

Statistics:

• 2020: 60% chose Security only
• 2023: 40% chose Security only
• 2025: 25% chose Security only
• 2026 trend: Security only is seen as “incomplete”

Why:

• Clients specifically ask for multiple criteria
• Vendor risk frameworks require broader coverage
• Competitive pressure (competitors have 3 or 4 criteria, you have only 1)

Impact

Higher costs: More criteria means more controls to test and higher audit fees. Security only: €40,000. Security, Availability and Confidentiality: €55,000-€70,000.

More implementation work: Availability controls (backups, disaster recovery, SLA monitoring) take extra effort. Confidentiality controls (data classification, DLP) do too.

Advice: Start pragmatically (Security, or Security plus Availability). Expand when clients ask for it. Do not proactively take on all five criteria just because you can.

5. Cloud-native and infrastructure as code

What is happening

Organisations are almost entirely in the cloud. Infrastructure as Code (Terraform, CloudFormation, Pulumi) is the norm.

New questions from auditors

IaC security: “Show me your Terraform code. How do you prevent misconfigurations?”

• Code review for IaC (peer review)
• Automated scanning (tfsec, Checkov, Terrascan)
• Terraform state locking (prevents concurrent changes)
• Version control for IaC (GitOps)

Immutable infrastructure: “How do you make changes to servers?”

• Not: SSH into a server and edit configs by hand
• Instead: destroy the old one and deploy a new one (containers, auto-scaling groups)
• The auditor checks: are the servers really immutable? Do engineers have SSH access? (It should be emergency-only.)

Cloud security posture management (CSPM): Tools that scan cloud configurations continuously.

• Wiz, Lacework, Orca, Prisma Cloud
• Detect misconfigurations: public S3 buckets, overly permissive IAM roles, unencrypted databases
• The auditor expects: CSPM is enabled and findings are followed up

Evidence:

• IaC code repositories
• IaC code review records
• CSPM dashboard screenshots
• Findings and remediation

6. Zero trust architecture

What is happening

The old model was perimeter security (firewalls, VPN). Inside the network was trusted. The new model is Zero Trust: never trust, always verify. Every request is authenticated and authorised, even internal ones.

What auditors look for

“Explain your network model.”

• Traditional: an office network with a VPN for remote workers
• Zero Trust: no corporate network, everything goes through an identity-aware proxy

Controls in Zero Trust:

• Strong authentication (MFA, certificate-based)
• Device trust (MDM, device posture checks)
• Application-level access control (not network-level)
• Continuous verification (session monitoring)
• Micro-segmentation (services cannot simply reach each other)

Evidence:

• Zero Trust architecture diagram
• Identity provider logs (Okta, Auth0)
• Device management (Jamf, Intune)
• Service mesh configurations (Istio, Linkerd)

Trend: Zero Trust is not required for SOC 2, but auditors see it as best practice. If you implement Zero Trust, many traditional controls (VPN, network segmentation) are set up differently.

7. Supply chain security

What is happening

Code dependencies, open-source libraries and CI/CD pipelines. Supply chain attacks have increased (SolarWinds, Log4j and others).

Auditor focus

Dependency management: “How do you manage third-party libraries?”

• Automated dependency scanning (Dependabot, Snyk, WhiteSource)
• Vulnerability alerting
• Patch SLA (critical dependencies patched within X days)
• Private package repositories (not pulling directly from npm or PyPI)

Software Bill of Materials (SBOM): “Can you produce an SBOM?”

• A list of all dependencies and their versions
• Tools: Syft, CycloneDX
• Some customers now request SBOMs

CI/CD security: “How do you secure your build pipeline?”

• Pipeline as code (GitOps)
• Secrets in CI (through vaults, not environment variables)
• Signed commits (GPG)
• Artifact signing (signing Docker images and binaries)

Evidence:

• Dependency scan reports
• SBOM documents
• CI/CD pipeline configurations
• Artifact signatures

8. Preparing for ransomware

What is happening

Ransomware is the number one threat. Auditors now ask explicitly: “Are you prepared for ransomware?”

What they want to see

Backup immutability: “Can ransomware encrypt your backups?”

• Backups in append-only or immutable storage
• Air-gapped backups (offline, not reachable from the network)
• Backup testing (can you restore if they are encrypted?)

Incident response for ransomware: “What is your playbook?”

• A ransomware-specific runbook
• Isolation procedures (cut off infected systems)
• A communication plan (customers, employees, authorities)
• A decision framework (pay or do not pay the ransom)

Ransomware drills: “Have you tested this?”

• A tabletop exercise simulating a ransomware attack
• Recovery testing from backups
• Measured time to recovery

Evidence:

• Backup immutability configuration
• Ransomware incident response plan
• Tabletop exercise meeting notes
• Recovery test results

9. Privacy: alignment with GDPR and CCPA

What is happening

The Privacy criterion (optional in SOC 2) is increasingly aligned with the GDPR (General Data Protection Regulation, the EU privacy law) and the CCPA (California Consumer Privacy Act).

What auditors expect

If you choose the Privacy criterion:

• A data subject rights (DSR) process
• Cookie consent management
• Data Processing Agreements (DPAs) with vendors
• Privacy impact assessments
• Data retention and deletion policies

Overlapping compliance: Many companies use SOC 2 Privacy to “prove” GDPR compliance to American clients who do not understand the GDPR.

Trend: The Privacy criterion grows from 15% (2020) to 20% (2025) to a projected 30% (2027), especially among consumer-facing SaaS companies.

10. Hybrid working and remote security

What is happening

Remote and hybrid work is here to stay. Security controls must suit a distributed workforce.

New controls

Endpoint management: MDM for all devices (laptops, phones)

• Encryption enforced
• Automatic updates enabled
• Remote wipe capability

BYOD policies: If people use their own devices:

• Containerisation (work data kept separate from personal data)
• VPN or Zero Trust access
• Security training specifically for BYOD

Home office security:

• Guidance on secure Wi-Fi (no public Wi-Fi for work)
• Physical security (lock the screen when away, privacy screens)

Evidence the auditor wants:

• MDM enrolment logs
• Device compliance reports
• BYOD policy document
• Remote work security training

Summary: how do you stay ahead?

1. Invest in automation: Compliance tooling is no longer “nice to have.” It is a requirement for continuous compliance.

2. Expand your scope proactively: Start with Security, add Availability once you are scalable, and consider Confidentiality if you process sensitive data.

3. Vendor management is a full-time task: It is no longer “check at onboarding.” It is continuous monitoring, quarterly reviews and proactive risk management.

4. Think cloud-native: IaC, CSPM, Zero Trust, microservices. Auditors expect modern architectures.

5. Stay informed:

• Follow AICPA updates 
• Read security blogs (Wiz, Lacework, Snyk blogs)
• Join compliance communities (r/compliance, compliance Slack groups)

6. Test your controls: Do not wait for the audit. Run quarterly internal audits, test your backup restores and simulate incidents.

The bottom line: SOC 2 in 2026 is not your father’s compliance framework. It is continuous, automated, risk-based and aligned with modern cloud architectures. Invest in tooling, adopt modern controls and stay proactive.

More information

• What is SOC 2: complete introduction
• SOC 2 in the Netherlands: how NIS2 and DORA drive demand
• Step-by-step plan: the 12 steps
• Controls: concrete implementations
• Trust Services Criteria: the 5 pillars
• AICPA Trust Services : official updates