How to get SOC 2 certification, a step-by-step guide by Koop: 7 steps from buyer requirement to report, a 3 to 12 month Type 2 review period, and 4 checks before you sign a CPA firm.

How to Get SOC 2 Certification: A Step-by-Step Guide

‍

For founders, CTOs, and security leads at B2B software companies, including teams whose product calls a third-party model API, SOC 2 certification is how you prove security controls to the enterprise buyers whose deals require it. To earn it, you put controls in place around the system those buyers rely on, and a licensed CPA firm tests the controls and issues a SOC 2 report. Buyers call that attestation report a certification. 

Key takeaways

  • A first SOC 2 certification ends with a CPA firm’s attestation report on your controls, and the decisions you make before any testing, starting with the report your buyers’ contracts require and the systems inside your boundary, set the project’s size and pace.
  • Pick the first Type 2 review period length based on when your buyer needs the report.
  • List every model provider and AI pipeline inside your system boundary during scoping.
  • Verify the CPA firm's license and peer review record before you sign the engagement letter.

SOC 2 certification requirements: Team, system access, deadline, and budget

Confirm these requirements before the SOC 2 readiness assessment:

  • An executive sponsor, such as the CEO or CTO, who approves the information security policy and signs management's assertion
  • Named control owners for access management, change management, incident response, vendor management, and employee onboarding and offboarding
  • Admin or read access to the systems holding SOC 2 evidence: cloud console (AWS, GCP, or Azure), identity provider, code repository, ticketing, and HR tools
  • A target report date tied to a live deal, renewal, or procurement deadline
  • A SOC 2 audit budget covering the CPA firm's fee, readiness work, compliance tooling, internal hours, and a penetration test

For an initial estimate, use Koop's compliance budget calculator. Early-stage teams can follow the sequencing in Koop's founder's cheat sheet for SOC 2. A first SOC 2 can run on spreadsheets and a shared drive, and a compliance automation platform handles the recurring evidence collection in the review period.

The SOC 2 certification process in seven steps

Flow diagram of the seven SOC 2 steps, labeled with the step headings, with Step 6 marked Type 2 only.

Figure 1. Seven steps from buyer requirement to shareable SOC 2 report

1. Confirm the report your buyers will accept

Start with the requirement in writing. The security exhibit, RFP, or questionnaire often names the report type, required categories, maximum report age, and bridge letter terms.

A Type 1 report tests control design on a single date. A Type 2 report also tests how the controls operated across a review period. For cost and timeline by type, read Koop's Type 1 vs Type 2 comparison, and use the SOC 2 Type 1 explainer to decide when a single-date report is enough.

Koop's Requirements Management runs contract-level compliance assessments and records the report type and categories each contract requires.

Expected result: A buyer requirements summary.

2. Define the system boundary and Trust Services Criteria

The system description tells the auditor what the report covers: the infrastructure, software, people, procedures, and data behind the product a customer buys. Keep the boundary to that product. Security, organized as common criteria CC1 to CC9, appears in every SOC 2 examination, and each optional category should trace to a commitment you make.

Table 1. Matching Trust Services Criteria to your commitments

If you commit to Include Evidence auditors request
Protecting systems and data from unauthorized access Security (required) Access reviews, change approvals, incident tickets, vulnerability scan results
An uptime SLA or service credits Availability Backup restore tests and disaster recovery exercise results
Keeping customer designs, source code, or model weights confidential Confidentiality Confidential data inventory and disposal records
Complete, accurate, and timely processing Processing integrity Processing specifications, input and output checks, error logs, reconciliations
Collecting or processing personal information Privacy Privacy notices and data subject request logs

Name every subservice organization, such as a cloud host or a model API provider, that performs part of your service, and choose a carve-out or inclusive method. 

Table 2. Subservice organization methods

Method What your report includes Typical fit
Carve-out Tests your controls and describes the complementary subservice organization controls you expect the provider to run A provider with its own SOC 2 report, such as a major cloud host
Inclusive Tests your controls and the provider’s controls together A provider that agrees to join your examination
with a cloud host and a model API outside the boundary as carve-out subservice organizations, and complementary user entity controls on the customer side

Figure 2. System boundary, carve-out subservice organizations, and customer controls

Expected result: An approved scope document.

3. Run a readiness assessment

Compare current practice against the in-scope criteria and log the gaps in a register. The AICPA's points of focus, last revised in 2022, illustrate ways to meet a criterion and leave control design to you.

Koop’s gap analysis tailors the control set to your scope and removes inapplicable items before remediation. For more detail before fieldwork, Koop's guide lists seven ways to prepare for a SOC 2 audit.

Expected result: A gap register.

4. Close gaps with controls your team can operate

A policy that promises access removal within 24 hours of departure means the auditor will check that timestamp for the leavers it samples. Write policies to match how the team works, then implement the control behind it.

Table 3. Common criteria evidence map, including AI systems

Criteria What auditors test Example evidence
CC1 Control environment Oversight, ethics, hiring Signed code of conduct, background checks
CC2 Communication and information Internal and external security communication Policy acknowledgments, published commitments
CC3 Risk assessment Risks from fraud, change, and AI use Dated risk register
CC4 Monitoring activities Periodic checks that controls work Penetration test, control monitoring results
CC5 Control activities Controls mapped to assessed risks Control matrix
CC6 Logical and physical access Provisioning, MFA, reviews, removal Access reviews, offboarding tickets, AI API key inventory
CC7 System operations Detection, vulnerabilities, incidents Scan results, alert tickets, incident reviews
CC8 Change management Authorized and tested changes Pull request approvals, model registry entries
CC9 Risk mitigation Vendor and disruption risk Vendor reviews, subservice SOC reports, insurance records

Expected result: An approved policy set.

5. Choose and vet a licensed CPA firm

A CPA firm performs the examination and signs the opinion. Compliance platforms, Koop included, prepare companies for fieldwork and can introduce firms. The AICPA’s SOC resource page notes that SOC auditors must follow professional standards, enroll in peer review, and hold a license. Run four checks before you sign:

  • License: search the firm on CPAverify, NASBA's free database covering 53 participating jurisdictions
  • Peer review: find the firm in the AICPA Peer Review Public File and request its latest accepted review
  • Approach: ask about scope, sampling, and independence, as the Journal of Accountancy advised clients in February 2026
  • Timeline: confirm the schedule leaves room to sample and test every control in scope

Read Koop's article on choosing a high-quality SOC 2 auditor before you shortlist firms.

Expected result: A signed engagement letter.

6. Operate controls through the review period

MJD, a CPA firm writing for the Cloud Security Alliance, reports that periods of 3 to 12 months are common and that some contracts set 12-month periods or a minimum length for a first audit.

Match control frequency to the period. A 3-month period contains one quarterly access review for the auditor to test, and a 6-month period contains two. Open the period once every control is operating, and schedule annual controls to fall inside it.

Koop's Housekeeper AI Agent updates audit evidence automatically, and continuous control monitoring flags an overdue control before the period ends. Systems without an integration need manual uploads, so assign an owner to each one.

Expected result: A dated evidence log for the review period.

7. Complete fieldwork and share the report

During fieldwork, the auditor samples control populations and inspects, observes, or reperforms the controls. Respond to any exception in writing and review the draft system description line by line because management signs the assertion behind it.

Share the final report under NDA through a Trust Center with access controls, next to the certificates of insurance that buyers also request. Reuse the same evidence to answer security questionnaires such as SIG, CAIQ, and VSA.

Schedule the next period to begin the day after the current one ends. A bridge letter, signed by your management, covers the gap between a period's end and a buyer's review. Google Cloud issues these letters monthly for its own SOC reports.

Expected result: The report lives in your Trust Center.

Working backward from your report deadline

Your report date depends on five phases, with Steps 1 and 2 inside readiness and Step 5 running alongside remediation.

Table 4. SOC 2 timeline planner

Phase Who sets the length Input to use
Readiness assessment Your team Number of in-scope criteria and systems
Remediation Your team Open items in the gap register
Review period (Type 2 reports) You and your auditor Buyer requirements and contract minimums
Fieldwork CPA firm Engagement letter
Report issuance CPA firm Engagement letter

To find the latest kickoff date, start from the buyer’s report deadline and subtract the planner’s phases from the bottom row up. For a Type 1 report, leave out the review period. 

What changed for SOC 2 in 2026

Table 5. AICPA actions affecting SOC 2 in 2026

Date AICPA action What to do
Feb 2026 Exposure draft (a proposed rule change) would revise the attestation standards CPA firms follow, effective for engagements starting on or after June 15, 2029, if finalized Keep designing controls to the current criteria, which the proposal leaves in place
Apr 2026 Ethics staff insights (AICPA staff guidance on auditor independence) cover CPA firms’ arrangements with SOC tool providers / Ask how the firm receives referrals and fees, including from any platform that introduced it Ask how the firm receives referrals and fees
May 2026 Peer Review Board reviewer alert (guidance for the CPAs who inspect audit firms) tells reviewers to check whether SOC 2 timelines are realistic and reports fit the client / Compare audit quotes on testing depth as well as price Allow fieldwork time your auditor can defend
Sep 2026 TQA Section 9561 (an AICPA technical Q&A) covers AI in SOC 1 and SOC 2 examinations Document how each AI tool touches the in-scope system

Common SOC 2 mistakes

Review-period gaps tend to surface once the auditor starts sampling:

  • A control owner leaves mid-period with no backup: Name a backup owner for every recurring control before the period opens.
  • A tool migration mid-period breaks evidence history: Export the old system’s records before cutover and tell the auditor about the change.
  • Incomplete populations: Keep full lists of hires, departures, and system changes for the auditor to sample from.

Next steps with Koop

Start this week:

  1. Pull the SOC 2 language from your three largest open deals.
  2. Run a gap analysis against the Security category.
  3. Shortlist two CPA firms and request a sample report from both

Koop’s SOC 2 solution offers a free Basic plan with the SOC 2 controls library and a Trust Center.

Map your SOC 2 scope with Koop.

Book a demo

Frequently asked questions

Is SOC 2 certification required by law?

Customers turn it into a requirement through contracts and vendor security reviews. The obligation comes from your agreements with buyers, and those agreements decide which report you need. Review that contract language with your auditor before scoping the examination.

How long is a SOC 2 report valid?

A SOC 2 report describes a fixed review period and stays usable for as long as buyers accept how recent that period is. When a buyer reviews the report after its period has closed, a bridge letter from your management covers the time between the period’s end and that review.

Does SOC 2 require a penetration test?

The Trust Services Criteria treat penetration testing as one of several ways to evaluate controls, and the points of focus under CC4.1 list it among ongoing and separate evaluations. Buyers often ask for a recent test in security questionnaires, and an annual test of the in-scope system meets that request. 

What is the difference between SOC 2 and ISO 27001?

SOC 2 produces a CPA firm’s attestation report.

Disclaimer:
Sources and dates checked October 15, 2026. For advice on your situation, consult your CPA firm or legal counsel.

Sources

  1. Schneider Downs, AI in SOC Examinations: What the AICPA's New TQA Section 9561 Means for Service Organizations, September 30, 2026, https://schneiderdowns.com/our-thoughts-on/ai-in-soc-examinations-what-the-aicpas-new-tqa-section-9561-means-for-service-organizations/ 
  2. Aprio, SOC 2 and AI in 2026: The Criteria Didn't Change, but the Examination Did, September 18, 2026, https://www.aprio.com/insights-events/soc-2-and-ai-in-2026-the-criteria-didnt-change-but-the-examination-did-ins-article/ 
  3. AICPA & CIMA, System and Organization Controls: SOC Suite of Services, accessed October 15, 2026, https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services 
  4. NASBA, CPAverify, accessed October 15, 2026, https://www.nasba.org/cpaverify/ 
  5. AICPA & CIMA, Peer Review for the public, November 17, 2023, https://www.aicpa-cima.com/resources/article/for-the-public 
  6. Journal of Accountancy, Promises of 'fast and easy' threaten SOC credibility, February 1, 2026, https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/ 
  7. Cloud Security Alliance, What should the scope period be for my SOC 2 Type 2 report? March 25, 2024, https://cloudsecurityalliance.org/articles/what-should-the-scope-period-be-for-my-soc-2-type-2-report 
  8. AICPA & CIMA, Key Elements of a SOC 2 Report: Resources for Management, June 5, 2025, https://www.aicpa-cima.com/resources/video/key-elements-of-a-soc-2-report-resources-for-management 
  9. Google Cloud, SOC 2, accessed October 15, 2026, https://cloud.google.com/security/compliance/soc-2 
  10. Journal of Accountancy, Proposed attestation changes: What CPAs should know, April 2026, https://www.journalofaccountancy.com/issues/2026/apr/proposed-attestation-changes-what-cpas-should-know/ 
  11. AICPA & CIMA, Ethics Staff Insights: Business arrangements with SOC tool providers, April 13, 2026, https://www.aicpa-cima.com/resources/article/esi-soc 
  12. Journal of Accountancy, AICPA guides peer reviewers to address SOC 2 risks, May 14, 2026, https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/ 
  13. AICPA & CIMA, TQA Section 9561 SOC Examinations: Effect of the Service Organization's Use of AI on SOC 1 and SOC 2 Examinations, September 11, 2026, https://www.aicpa-cima.com/resources/download/tqa-section-9561-soc-examinations-effect-of-the-service-organizations-use-of-ai-on-soc1-and-soc2-examinations 
  14. AICPA & CIMA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022), September 30, 2023, https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022

‍

View All
article highlights:
Link
Link
Share the article: