Skip to Content
SOC 2SOC 2 in the Netherlands

SOC 2 in the Netherlands: the report explained

A SOC 2 report in the Netherlands is exactly the same as a SOC 2 report: an independent opinion from an accountant on your IT security. Because SOC 2 is a US standard from the AICPA , Dutch IT auditors carry it out under the international ISAE 3000  standard. The Dutch professional body NOREA  provides guidance for its registered EDP auditors (register-EDP-auditors).

More and more Dutch companies are asked: “Do you have a SOC 2?” This is driven by enterprise clients, but also by new legislation. Below you can see who asks for it, how it is organised here, and what it costs.

In the Netherlands, you usually get an “ISAE 3000 SOC 2 report” from a registered IT auditor (RE). NOREA calls this a SOC 2 equivalent. Whether your US client accepts it as a SOC 2, check in advance. See American clients and a Dutch auditor.

Who asks for a SOC 2 in the Netherlands?

Nobody is legally required to have a SOC 2. Even so, for many Dutch suppliers it is a de facto requirement. The request mainly comes from:

  • Enterprise clients: large companies that use your software or cloud and include you in their vendor risk management.
  • American clients: they know SOC 2 and ask for it by default in their RFP.
  • Banks and insurers: financial institutions set strict requirements for their IT suppliers.
  • Investors: during due diligence from a later funding round.

If you only have Dutch SMB clients who never ask for it, ISO 27001 is often the more logical choice for the European market. Not sure? Compare SOC 2 with ISO 27001.

How does SOC 2 work with ISAE 3000 and NOREA?

SOC 2 was designed for US accountants (CPAs). In the Netherlands, a registered IT auditor (RE) can do the same work under ISAE 3000, the international assurance standard for non-financial engagements.

According to NOREA, the result is a SOC 2 equivalent, based on the AICPA criteria. NOREA, the professional body for Dutch IT auditors, published guidance on this in 2016. Note the difference with ISAE 3402: that standard is used for financial outsourcing (SOC 1), not for security. Read how the two standards relate to each other on ISAE 3000 vs ISAE 3402.

StandardISAE 3000 (for SOC 2 security)
Who signsRegistered IT auditor (RE), affiliated with NOREA
Report nameISAE 3000 SOC 2 report
Valid for US clientsAsk in advance

How NIS2 and DORA drive demand

Two European laws mean that more and more Dutch organisations ask their IT suppliers for assurance. A SOC 2 report is then a handy way to demonstrate it.

NIS2 (Cyberbeveiligingswet, the Dutch Cybersecurity Act): this law requires organisations in essential and important sectors to demonstrably have their cyber security and supply chain in order. The Dutch Cybersecurity Act is expected to take effect on 1 July 2026. Companies covered by it will more often ask their suppliers for evidence of security. Check the current position with the NCSC (National Cyber Security Centre) .

DORA: the Digital Operational Resilience Act has applied to the financial sector since 17 January 2025. DORA requires banks, insurers and investment firms to manage the risk of their ICT suppliers. If you supply IT services to this sector, a SOC 2 report helps you show that your security is in order. See the European regulator ESMA (European Securities and Markets Authority)  for details.

NIS2 and DORA do not require a SOC 2 by name. But they do require you to control your supplier risk. A SOC 2 report is a recognised piece of evidence for that.

The Dutch auditor landscape

In the Netherlands, an IT auditor usually carries out a SOC 2. The relevant title is RE (Register EDP Auditor), affiliated with NOREA. For what that title means for the report, read the page on the RE auditor. A Dutch report is not automatically accepted everywhere, certainly not by American clients. For that, see Do American clients accept a SOC 2 from a Dutch auditor?.

Where do you find them?

  • Big Four firms: Deloitte, PwC, EY, KPMG (more expensive, strong brand)
  • Mid-sized firms: BDO, Mazars, Baker Tilly, RSM
  • Specialist IT audit and assurance firms

Always ask whether the firm has experience with SOC 2 specifically. Not every IT auditor does this regularly. Read how to choose an auditor in the frequently asked questions.

What does a SOC 2 cost in the Netherlands?

Prices are in line with the international market. For a mid-sized company, expect €45,000-€80,000 in audit fees for a Type II, plus tooling and internal time. The full picture by company size is on the costs and timeline page.

Dutch firms are priced comparably to US firms. The advantage: they can combine ISAE 3000 and SOC 2 in one engagement, which is useful if you also serve European clients.

More information

Internal auditor and SOC 2RE auditor and SOC 2