SOC attestation, explained and executed without the runaround.
There's no such thing as a "SOC certificate" — a CPA attests that your systems and controls are in place. We do the preparation work so that attestation goes smoothly the first time.
SOC 2, answered directly
By Joe Engelking, CEO. Updated October 2026.
What is SOC 2?
SOC 2 is a report from an independent CPA firm on how a service organization protects customer data. It evaluates your controls against criteria for security and, optionally, availability, processing integrity, confidentiality, and privacy. It is an attestation, not a certificate, and customers often ask to see it.
Who needs a SOC 2 report?
Service providers whose customers need proof of real security controls, such as software companies, data processors, and IT providers. No law requires it. Customers and large prospects ask for it during vendor reviews, and without one a deal can stall in a security questionnaire.
What do SOC 2 auditors actually look at?
Auditors look at your written policies, access controls, device and network monitoring, change management, vendor management, incident response, and staff training, along with evidence that you follow them. For a Type 2 report, they test that the controls worked consistently over a period of months.
How should a small company prepare for SOC 2?
Write down your policies, enroll devices in monitoring, require multifactor authentication, train staff and keep records, test your backups and recovery plan, and set up alerting for signs of a breach. A readiness review first shows the gaps, so the audit itself goes smoothly.
| Control area | What the auditor wants to see | What has to be in place |
|---|---|---|
| Device monitoring | Every device is managed and watched | Endpoint detection and response on all devices |
| Staff training and policies | Documented training and a policy handbook | Training completed with records |
| Breach controls | Controls that prevent and contain an incident | Access controls and a response process |
| Sensitive data | Extra protection for personal, financial, and customer data | Encryption and limited access |
| Recovery | A plan to restore service after an outage | A documented, tested disaster recovery plan |
What is a SOC 3 report?
A SOC 3 report is the general-use version of a SOC 2. It covers the same trust services criteria but with less detail, so it can be shared publicly, for example on a website or in a sales proposal. The full SOC 2 report is usually shared with customers and prospects under an NDA. An independent CPA firm issues both, and we help you build the controls and evidence that either report depends on.
What is the difference between SOC 1 and SOC 2?
SOC 1 reports on controls that affect a customer’s financial reporting, so it is common for payroll, billing, and similar service providers. SOC 2 reports on controls for security and, optionally, availability, processing integrity, confidentiality, and privacy, which is what technology and data-handling providers usually need. Which one you need depends on what your customers are asking for.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report describes whether your controls are designed properly at a single point in time. A Type 2 report tests whether they worked over a period of time, typically several months. Customers usually ask for Type 2 because it shows the controls operate consistently, and many companies get a Type 1 first as a milestone.
How long does SOC 2 compliance take?
It depends on where your controls and documentation start. Writing policies and closing gaps comes first, and a Type 2 report then requires an observation period before the auditor can report. We map the timeline after a readiness assessment instead of quoting a generic number.
We prepare you; a CPA attests.
Controls & policy handbook
We build the policies and procedures your SOC attestation actually requires, in a handbook your team can follow.
Type 1 to Type 2
We get you through your initial Type 1 attestation, then manage the roughly 6-month period of adherence needed for Type 2.
Trusted CPA pairing
We pair you with a CPA we know and trust, and tell you exactly what they'll expect from you going in.
What SOC auditors actually want to see.
- Device monitoring & EDR
- Documented staff training & policy handbook
- Breach controls in place
- Extra protection for PII, financial & customer data
- A disaster recovery plan
- Alerting for signs of a breach
A SOC 2 attestation is essentially a cybersecurity audit.
Vendors and partners ask for SOC compliance because it proves your security controls are real, not just claimed. We know what auditors look for and build straight toward it — realistic deadlines, managed start to finish, without the overkill some firms sell you.
Real businesses, real relationships.
“When Joe assigned Ivan as our lead, we felt like we finally had IT solved. Ivan has been with us 24×7 and the team behind him makes sure nothing falls through the cracks.”
“We’ve been using LME Services for our business IT support, and the experience has been fantastic. Their cybersecurity expertise, responsiveness, and ability to explain complex tech in plain English really set them apart.”
Common questions
Type 1 is a one-time attestation of your policies and controls at a point in time. Type 2 requires you to adhere to those controls for roughly 6 months before a CPA can attest to that ongoing performance — you need Type 1 before you can pursue Type 2.
No — a SOC report is an attestation performed by an AICPA-certified CPA, not a certificate issued after a scan. We prepare your controls and documentation, then connect you with a CPA we trust to perform the attestation.
Type 1 can move relatively quickly once your controls are documented. Type 2 requires roughly 6 months of adherence before the CPA can attest — the earlier you start, the more time you have to fix issues before they show up in the report.
No — an independent CPA performs the attestation, as required. We build the controls, policies, and evidence beforehand so that attestation goes smoothly.
Let's talk about your IT.
See how this fits into our full Compliance & Regulated Industry IT Guide, organized by industry: healthcare, legal, finance, non-profit, and manufacturing.
See the Full Guide