In short
SOC 2 (System and Organization Controls 2) is a report by an independent, licensed CPA firm on how a service organisation’s controls meet the AICPA Trust Services Criteria. It is voluntary, but US clients often ask Indian software and IT vendors for one before signing. Security is always included. A Type 2 report, the one most clients want, tests whether controls such as access reviews, change management and logging actually worked over several months.
Who it applies to
SOC 2 is voluntary. Nobody in India requires it by law. Those who need it, and those who ask:
- SaaS, hosting and IT service vendors that store or process client data. US clients’ security, vendor risk and compliance teams are the usual readers.
- Indian vendors selling to US enterprises. A SOC 2 report answers many security questionnaire items at once, so it often comes up during procurement.
- Who issues it. Only a licensed CPA firm can perform the examination, under AICPA attestation standards. Ask which firm signs the opinion.
Type 1 and Type 2. A Type 1 report gives an opinion on control design as of one date. It is not evidence that controls worked. A Type 2 report also tests operating effectiveness over a period. Sources commonly give 3 to 12 months; some auditors look for at least six.
SOC 1, SOC 2 and SOC 3. SOC 1 covers controls that could affect clients’ financial statements, such as payroll or billing processing. SOC 2 covers the Trust Services Criteria. SOC 3 is a short, general-use version of a SOC 2 Type 2 that can be published.
SOC 2 and ISO 27001. ISO/IEC 27001 certifies a management system, with a certificate valid for three years. SOC 2 is a CPA’s opinion on controls over a defined period, repeated each year. US clients tend to ask for SOC 2; others often ask for ISO/IEC 27001. The underlying controls overlap heavily. See ISO 27001.
What it means for your website
SOC 2 has no requirements written specifically for websites. If your customer portal or web app is part of the service being examined, its access control, changes and monitoring are tested like the rest of the system. Do not call yourself SOC 2 certified, because it is a report, not a certificate. A SOC 3 report can be published on your site, while a SOC 2 report is shared with clients and partners on request, usually under a non-disclosure agreement.
What it means for your software
The Trust Services Criteria in scope
The five categories are security, availability, processing integrity, confidentiality and privacy. Security is in every report. Add availability if clients depend on uptime, processing integrity if you process transactions for them, confidentiality for business secrets, and privacy for personal data. Each category you add means more controls to show. The AICPA has also published an exposure draft of revised criteria, so check which version your auditor will use.
Access reviews
Every user needs an individual login with role-based permissions. Access must be approved, reviewed on a schedule and removed promptly when people leave. In a Type 2 audit, the auditor samples these reviews across the period, so the system should export user lists with roles and last login.
Change management
Every change to production needs a request, approval, testing and a record of who deployed it. Developers should not push straight to production without review. An audit trail of data changes, with before and after values, helps show that changes inside the application were authorised.
Logging and monitoring
Log logins, failed attempts, permission changes, admin actions and changes to key records. Protect logs from editing and keep them long enough to cover the audit period. Someone must review alerts, and the review itself must leave a record.
Vendor management
Your cloud host, email provider and other subprocessors are part of your service. Keep a vendor list, review each vendor’s own SOC 2 or ISO/IEC 27001 evidence, and sign contracts that cover security and confidentiality.
Incident response
Write down how you detect, escalate, fix and report incidents, and who tells clients. Test the plan. In India, also align it with the CERT-In six-hour reporting rule; see CERT-In directions.
Availability and backups
If availability is in scope, show monitoring, capacity planning, tested backups and a recovery plan. A backup that has never been restored is weak evidence.
Checklist
- Ask your clients which report they need: SOC 2 Type 1, Type 2 or SOC 1.
- Define the system in scope: the product, its infrastructure, people and vendors.
- Pick the Trust Services Criteria: security plus only the categories clients need.
- Run a readiness assessment with your chosen CPA firm or an adviser to find gaps.
- Set up role-based access with scheduled access reviews.
- Put every production change through request, approval, testing and a deployment record.
- Turn on security logging and record alert reviews.
- Build a vendor register and collect each vendor’s security reports.
- Write and test an incident response plan.
- Run the controls for the full observation period before the Type 2 examination.
How Kreon helps
We build role-based access, logging and an audit trail with before and after values into the ERP, CRM and SaaS systems we deliver. That gives your CPA firm the evidence it samples. We can prepare a system for a SOC 2 examination and fix the gaps found in readiness reviews. The report itself must come from a licensed CPA firm.