A security questionnaire lands in your inbox from a prospect you really want to win. Question 14 asks for your SOC 2 report, and question 15 asks how you manage vendor access. "We take security seriously" isn't going to be enough.
Buyers are asking harder questions for a reason. The Verizon 2025 Data Breach Investigations Report found that the share of breaches involving third parties doubled to 30%. Every vendor with access to customer data is now part of the customer's risk.
SOC 2 compliance is how you answer those questions with evidence. The requirements look long at first, but they group into a handful of control areas that most businesses can work through one at a time.
In this blog, you will learn what SOC 2 compliance is, the five Trust Services Criteria, the eight key SOC 2 compliance requirements, how Type 1 and Type 2 differ, the steps to become SOC 2 compliant, and the common mistakes to avoid.
Key Takeaways
- SOC 2 is voluntary but expected: No law requires it, yet enterprise buyers increasingly treat a current report as a condition of doing business.
- Security is the only mandatory criterion: Availability, processing integrity, confidentiality, and privacy are added based on what customers need.
- Requirements are outcomes, not a fixed list: The AICPA doesn't prescribe exact controls, so you design controls that fit your environment and prove they work.
- Identity controls carry the most weight: MFA, role-based access, and prompt offboarding appear in almost every audit.
- Monitoring produces the evidence: 24/7 monitoring and centralized logging create the records auditors ask for.
- Compliance is annual, not one-time: Most customers expect a fresh report every year.
What Is SOC 2 Compliance?
SOC 2 compliance means your controls have been examined by an independent CPA firm against the AICPA's Trust Services Criteria, and the firm has issued a report with its opinion. It is an attestation, not a government certification, and no agency issues a SOC 2 badge.
The businesses most often asked for SOC 2 are SaaS companies, cloud providers, IT and managed service providers, and any vendor that stores or processes customer data on a client's behalf.
Is SOC 2 Mandatory?
No. Unlike HIPAA, SOC 2 is not a law. But large organizations routinely require vendors to produce a current SOC 2 report and resubmit it annually, according to Dark Reading's reporting on SOC 2 attestation practices.
In practice, that makes SOC 2 a contractual requirement for many vendors, even though no regulator enforces it.
Understanding what compliance means makes it easier to see what auditors measure it against.
The 5 Trust Services Criteria Explained
The AICPA defines the criteria in its 2017 Trust Services Criteria, with revised points of focus from 2022. You choose the criteria that match your services and what customers expect.
Here are the five criteria and what each one covers:
1. Security (Required)
Protection of systems and data against unauthorized access. It's the baseline in every SOC 2 report and is often called the "common criteria."
2. Availability
Whether systems remain available and recoverable at the levels you've committed to. It usually brings disaster recovery planning and uptime commitments into scope.
3. Processing Integrity
Whether data is processed completely, accurately, and on time. It matters most for billing, payments, and transaction platforms.
4. Confidentiality
How sensitive business information, such as contracts or intellectual property, is classified, encrypted, and disposed of.
5. Privacy
How personal information is collected, used, retained, and disclosed, including consent and breach notification.
Most businesses start with Security alone, then add Availability or Confidentiality when customers raise them in questionnaires. With the criteria chosen, the next step is knowing which controls sit behind them.
8 Key SOC 2 Compliance Requirements
There's no universal checklist, because your scope depends on your services, hosting model, and size. Still, the same control areas appear in nearly every SOC 2 audit.
Here are the requirements most businesses need to meet:
1. A Documented Information Security Program
Written policies covering acceptable use, access, encryption, and data handling, reviewed at least once a year and acknowledged by staff.
2. Formal Risk Assessment
A documented review of threats to your systems, updated at least annually, with owners and dates for each risk you decide to address.
3. Access Management
Role-based access tied to job function, MFA on all critical systems, periodic access reviews, and same-day removal of access when someone leaves.
4. Monitoring and Logging
Continuous monitoring of security events, with logs collected centrally so suspicious activity is spotted and investigated.
5. Threat Detection and Response
Tools that pair detection technology with people who investigate alerts and act on them, around the clock.
6. Technical Safeguards
Endpoint protection, vulnerability scanning, encryption at rest and in transit, and documented change management for systems and software.
7. Vendor Risk Management
An inventory of third parties that touch your data, contracts that define their responsibilities, and a review of their own security reports.
8. Incident Response and Recovery
A tested incident response plan with escalation and notification steps, plus backups with documented recovery targets and periodic test restores.
The table below turns those requirements into a working checklist:
| Control Area | What Auditors Expect | Evidence to Keep |
|---|---|---|
| Governance | Approved policies and a named security owner | Signed policies and acknowledgments |
| Risk management | An annual risk assessment | Risk register with owners and dates |
| Access | MFA, least privilege, and prompt offboarding | Access reviews and termination tickets |
| Monitoring | Centralized logs and alert review | Alert records and investigation notes |
| Vendors | Due diligence on third parties | Vendor list, contracts, and their SOC reports |
| Incident response | A documented, tested plan | Tabletop results and incident records |
| Recovery | Backups and a disaster recovery plan | Test-restore logs and RTO and RPO targets |
Many businesses stall here, not because the requirements are complex, but because running 24/7 monitoring, MFA, and response in-house takes real technical bandwidth. Once the controls exist, the next question is how the auditor tests them.
Also Read: Cybersecurity Solutions for Small Businesses
SOC 2 Type 1 vs Type 2: What's the Difference?
Both reports use the same criteria. The difference is whether the auditor looks at a single date or a period of months.
The following comparison helps explain how they differ:
| Aspect | Type 1 | Type 2 |
|---|---|---|
| Question answered | Are controls designed properly? | Did controls operate effectively over time? |
| Time frame | As of one date | A review period, typically 3–12 months |
| Evidence required | Policies, configurations, and walkthroughs | Records covering the entire period |
| Speed | Faster, since no observation window is needed | Slower, since months of operation must be observed first |
| Buyer view | Often accepted as an interim step | The standard for long-term vendor reviews |
| Best for | A first report under deadline | Long-term vendor relationships |
To be fair, Type 1 wins on speed and is a sensible first step when a deal is waiting. For long-term customers, though, Type 2 is usually where the conversation ends up, which is why operating effectiveness should be the goal from the start.
Testing ends in a formal opinion. An unqualified opinion is the clean result, a qualified opinion flags material problems in specific areas, an adverse opinion signals widespread failures, and a disclaimer means the auditor couldn't gather enough evidence. Customers will expect an explanation of any exception, even in a clean report.
Knowing how the report works makes the path to compliance much clearer.
Also Read: SOC 2 Type 2 Compliance: A Guide
5 Simple Steps to Become SOC 2 Compliant
Becoming SOC 2 compliant follows a predictable sequence. Preparation and the audit are usually handled by different parties.
The following steps outline the typical path:
Step 1: Scope the Criteria and Systems
Decide which services, systems, and Trust Services Criteria are in scope, based on what customers actually ask for.
Step 2: Run a Readiness Assessment
Compare current controls against the checklist above and rank the gaps by severity, so the biggest risks are fixed first.
Step 3: Remediate the Gaps
Put missing controls in place, such as MFA, cyber protection plans with 24/7 monitoring, written policies, and tested backups.
Step 4: Gather Evidence Continuously
Collect logs, tickets, and sign-offs as controls run, not in the week before the audit. For Type 2, the evidence must cover the whole period.
Step 5: Engage a Licensed CPA Firm
An independent CPA firm performs the formal attestation and issues the report. Some businesses also request a SOC 3 summary for public use.
Following these steps gets you to a first report. Keeping it current is where many businesses slip.
Also Read: Ensuring HIPAA Compliance in the Cloud
Common SOC 2 Compliance Mistakes to Avoid
Even well-prepared businesses run into the same avoidable problems. Here are the ones to watch for:
- Treating SOC 2 as one-and-done: Most customers expect a new report every year, so controls must keep running between audits.
- Under-scoping the criteria: Leaving out Availability or Confidentiality can mean a second audit when a buyer asks for it.
- Policies without proof: A written access policy means little if access reviews and offboarding records don't exist.
- Ignoring vendors: Subservice providers need to be identified, and their own reports collected, before fieldwork.
- Untested backups: A disaster recovery plan that has never been restored from won't satisfy an auditor or a real incident.
- No named owners: Every control needs a person responsible for running it and producing its evidence.
Avoiding these mistakes keeps compliance steady from one audit cycle to the next.
How LME Services Helps Businesses Meet SOC 2 Requirements
Most small and mid-size businesses understand the checklist. What they lack is the time and technical staff to build the controls, run them every day, and document everything in a way an auditor will accept.
LME Services has kept Chicagoland businesses running since 1994 as a family-run, second-generation managed IT and cybersecurity provider in Hoffman Estates, Illinois. Leon Engelking launched it after his IBM career, and his son, CEO Joe Engelking, now heads new business and client relationships. Leon credits the company's staying power to more than technical skill: "Over the years, our business developed a reputation not just for the quality of service but for the way we provide it."
SOC 2 compliance services at LME include:
- SOC 2 Compliance Consulting Services
- Compliance Audit Services for Business
- Cybersecurity Audit Services for Your Business
- SOC 3 Report Compliance Support
- Managed Detection and Response
- Managed SIEM Services for Stronger Security
- IT Security Solutions for Businesses
Here's what sets LME apart:
- Preparation with a clear line to the auditor: LME builds the controls and policy handbook, then pairs clients with a trusted AICPA-certified CPA for the independent attestation.
- Identity controls done properly: Identity and access management covers MFA on every sensitive account, SSO, role-based access, same-day offboarding, and privileged access management.
- Round-the-clock monitoring: Every cybersecurity plan is backed by a 24×7 SOC team, with MDR and a shared SIEM platform correlating logs across firewalls, servers, workstations, and cloud apps.
- Proven PII protection: For James G. Dades & Co., a Midwestern CPA firm with FTC and PII compliance gaps, LME delivered a risk assessment, 2FA, PII monitoring, layered backups, handbooks, BAAs, and privileged access management. The result "lowered their breach risk, added a real disaster recovery plan."
- Incident response built in: Plans include containment steps, named roles, evidence preservation, and notification requirements, including Illinois breach-notification rules.
- Recognized security work: Clutch ranked LME second among Chicago's top cybersecurity companies in 2019, and clients rate it 4.9 stars across 30 Google reviews.
- No lock-in: A free 15-minute consultation starts the conversation, and plans come with a satisfaction guarantee and a 30-day opt-out on a 1-year agreement.
This approach helps businesses turn a long SOC 2 checklist into controls that run every day and evidence that's ready when the auditor asks.
Conclusion
SOC 2 compliance comes down to five criteria, eight core control areas, and the evidence that those controls work. What shapes your results is choosing the right scope, closing gaps before the audit, and keeping controls running between reports.
Picking the right partner is a big part of getting there. Real monitoring, strong identity controls, and clear documentation often decide how quickly a business moves from questionnaire to report.
If you're working through SOC 2 requirements, connect with the LME Services team today for a free 15-minute consultation, and find out which controls you need to close the gap.
Frequently Asked Questions
What are the SOC 2 compliance requirements?
SOC 2 requires controls that meet the Trust Services Criteria you choose, with Security always included. In practice that means documented policies, risk assessment, access controls with MFA, monitoring, vendor management, incident response, and recovery.
Who needs to be SOC 2 compliant?
SaaS companies, cloud providers, IT service providers, and any vendor that stores or processes customer data are the usual candidates. The need is usually driven by a customer or investor rather than a law.
How do I become SOC 2 compliant?
Scope the criteria, run a readiness assessment, fix the gaps, gather evidence continuously, and engage a licensed CPA firm for the audit. Preparation and attestation are handled by different parties.
How often is SOC 2 compliance required?
There's no legal schedule. In practice, customers ask for a fresh report every year, so controls and evidence collection have to keep running between audits.
What kinds of tests are included in a SOC 2 audit?
Auditors review documents, interview staff, observe controls, and test samples of evidence. For Type 2, they check that controls operated consistently across the whole observation period.
