Is there a SOC 2 certification, and what do customers actually receive?
There is no SOC 2 certificate. A SOC 2 is an attestation report issued by a licensed CPA firm after an examination against the AICPA's 2017 Trust Services Criteria. A Type 1 report gives the auditor's opinion on whether the system description is fairly presented and the controls are suitably designed as of a specified date. A Type 2 report adds an opinion on whether those controls operated effectively over a specified period, along with the auditor's tests and results. When a customer asks for SOC 2, the document they should expect is that report, usually with management's written system description and assertion attached, not a badge or a letter saying the company is compliant.
What you can hand over depends on three decisions. The first is the report type, since a Type 1 and a Type 2 support different levels of reliance. The second is the trust services categories in scope, because security is always included through the common criteria CC1 to CC9, while availability, confidentiality, processing integrity and privacy are added only when they apply to the service. The third is the auditor, because only an independent CPA firm can issue the report. Ask the customer which report type and categories their vendor review requires, and check whether they accept a restricted SOC 2 report or need a general use SOC 3 instead.
Ownership is split in a way that matters for planning. The organization owns its controls and the assertion that describes them. An implementation partner such as DeployOpen, if engaged, can prepare systems, configuration, evidence collection and documentation for the examination, but it does not issue audit reports, attestations or certificates. Before signing anything, confirm with your CPA firm which of the required artifacts it expects management to produce. You can verify a firm's license status through CPAverify, a free license search hosted by NASBA.
Who may issue a SOC 2 report and who may not
Only a licensed CPA firm can issue a SOC 2 report. The SOC 2 is an attestation engagement performed under the AICPA's attestation standards, and the service auditor's written opinion is the product. That opinion covers whether management's system description is fairly presented, whether controls are suitably designed, and, in a Type 2 report, whether controls operated effectively over a period. The firm must also be independent of the client and apply the AICPA Code of Professional Conduct in full, with limited modifications for attestation engagements.
- What it can attest: Control design and, for a Type 2, operating effectiveness, based on its own risk assessment, testing and sampling.
- What it cannot do: Design or operate the client's controls and then certify them, since that would compromise independence.
- Who signs: The report is issued by the CPA firm under its name, not by the client or a software product.
- Licensing: Verify the engagement partner's license status with the relevant state board, or through CPAverify, a free license search hosted by NASBA.
- Scope of the opinion: The report covers the system and criteria in the examination only, so an opinion on one product line does not extend to the whole company.
Ask the firm to confirm its license, its peer review status, and whether it has any relationship with the tool vendor used in your environment.
The service organization owns the system, the controls and the assertion. Management prepares the system description, selects the trust services categories, and provides written representations to the auditor. Under AT-C section 205 the examination is assertion-based, so the organization's statements are the subject the CPA tests. The organization cannot issue the SOC 2 report itself, and it cannot make the report say more than the CPA opinion supports.
- What it can attest: Its own description of the system and its management assertion, which it must make in writing.
- What it cannot attest: That its controls are independently effective, because management's own statements do not substitute for the service auditor's testing.
- Representation letter: Management signs a representation letter confirming matters such as the completeness of the system description and disclosure of known exceptions.
- Internal statements: A trust page, security questionnaire answer or sales claim that says the company is SOC 2 compliant is management speaking for itself, not an examination result.
- Sharing the report: The organization decides who receives its report, subject to the report's use restrictions, and may share a SOC 3 more widely.
Check that management's written assertion and the auditor's opinion refer to the same system, dates and criteria.
Implementation partners and compliance tool vendors help prepare systems, policies, configurations and evidence. This work is useful and common, but it sits upstream of the examination. Most SOC tool providers are not CPA firms, and the Journal of Accountancy reported in February 2026 that they cannot attest that controls are effective. A partner that prepares evidence can show the auditor what exists, but it cannot give the opinion that the controls work.
- What they can do: Build controls, configure logging, collect evidence, draft policies, and run readiness reviews that flag gaps.
- What they cannot attest: Whether controls are suitably designed or operating effectively, since that is the CPA's conclusion.
- Independence risk: If a vendor has a referral or revenue arrangement with the audit firm, the AICPA's ethics guidance treats that as a risk to the examination's independence.
- Promises of speed: Claims that a tool can make an organization compliant in hours or weeks conflict with how examinations are performed.
- Your role: The organization still owns the controls, so vendor work does not transfer accountability.
Ask for a written statement of what the vendor delivers and confirm in writing that the CPA firm you engage has no conflicting arrangement with it.
No body issues a SOC 2 certificate, and no vendor can declare an organization SOC 2 certified or compliant. The term compliance does not appear in SOC 2 examinations. Sellers who offer a certificate, a badge or a stamp of approval are selling something that the examination does not produce. The AICPA Code prohibits false or misleading advertising and treats guarantees of a clean audit or a 100% pass rate as improper, and describing an auditor as AICPA-approved is also a prohibited example.
- Certificates: A SOC 2 is a report with opinions, not a certificate. Anyone offering one is describing a different product.
- Self-declared badges: A badge displayed by the organization or a vendor is not an independent result.
- Logo use: The AICPA SOC logo may be used only by a service organization that has received a SOC 1, SOC 2 or SOC 3 report from a licensed CPA, and the AICPA requires reading its logo guidelines first.
- Guarantees: Promised outcomes such as a clean opinion on a fixed date are a warning sign.
- Verification: Ask for the report itself and confirm the issuing firm's license independently.
If a seller cannot name the CPA firm that will issue the report, treat the offer as unsupported.
What the AICPA SOC logo means and who may display it
The AICPA SOC for Service Organizations logo may be displayed by a service organization that has received a SOC 1, SOC 2 or SOC 3 report from a licensed CPA or a non-US equivalent. The logo therefore points to one fact: a CPA examination report exists. It does not mean a standard was certified, that a product is compliant, or that the AICPA endorsed the company. Before you accept a logo as evidence, ask for the report itself, check which report type it is, and confirm the report period or as-of date. A SOC 2 is an attestation report, and the logo carries no meaning apart from it.
The AICPA asks organizations to read its logo guidelines before downloading or displaying the logo on a website. Those guidelines govern how the mark may be used, so a company that copies the artwork without reading them may be misusing it even when a real report exists. When you review a vendor's trust page, check that the logo sits alongside a named CPA firm, a report type, and a period or date. If the page shows the logo with no report, no auditor, and no way to request the report under a non-disclosure agreement, treat that as a red flag and raise it with the vendor before you rely on the claim.
Logo use also needs a second check. The AICPA's own ethics guidance bars false or misleading advertising, and tool vendors that promise compliance in days are the kind of marketing this rule is meant to police. A logo placed next to the word "compliant" or beside a self-issued badge signals a claim the examination never made. Ask the vendor which CPA firm issued the report, then verify that firm's license and peer review status before relying on it. Your own procurement file should record the report type, period, auditor and the date you reviewed it.
Why claims of SOC 2 compliant in days deserve scrutiny
Several common sales claims about SOC 2 sound plausible but conflict with how the examination works. Each card below names one claim, explains why it does not hold up, and gives the question to put to the vendor or firm before you sign anything.
Is it a SOC 2 certificate?
A SOC 2 is not a certificate of compliance. It is an attestation report issued by a licensed CPA firm, containing opinions on the system description and controls as of a date (Type 1) or over a period (Type 2). The term compliant is not used in SOC 2 examinations, so a vendor saying "we are SOC 2 compliant" is describing something the examination does not produce. Ask: which CPA firm issued the report, and what period or date does it cover?
Who promises a report in weeks?
The Journal of Accountancy reported in February 2026 that SOC tool vendors, now numbering in the dozens, may promise compliance in weeks or even hours. Most of these providers are not CPA firms and cannot attest that controls are effective. A tool can help assemble evidence, but the report timeline depends on observation periods and fieldwork by the CPA firm. Ask: which CPA firm will sign the report, and how many weeks before the report date will they start testing?
Can anyone guarantee a clean audit?
The AICPA Code prohibits CPAs from guaranteeing outcomes such as a clean audit or a 100% pass rate, and bars false or misleading advertising. A consultant or tool vendor that guarantees an unqualified opinion is making a promise the independent auditor alone controls, because the opinion depends on what testing finds. Ask: what do you commit to in writing about deliverables and readiness, and what is left to the auditor's judgment?
Is the firm AICPA-approved?
Describing an auditor as AICPA-approved is a prohibited example under the AICPA Code. Membership, a logo on a website, or a peer review entry does not make a firm approved by the AICPA for any particular engagement. The SOC logo is also governed by guidelines that the service organization must read before displaying it. Ask: what is the firm's license number, and can you show its current peer review report?
Does a green dashboard prove controls?
A compliance dashboard showing green checks confirms that a configuration or task was marked complete in the tool. It is not an attestation. A CPA must test whether controls were suitably designed (Type 1) or operated effectively over the period (Type 2), select samples, review evidence and issue an opinion. Ask: which controls does the CPA firm test directly, and which ones rely only on screenshots or integration status?
Is the auditor licensed?
Only a licensed CPA firm can issue a SOC 2 report. Before you rely on a report, confirm the signing firm's license status in CPAverify, a free license search hosted by NASBA and built on official data from 53 participating jurisdictions. It shows license status and flags state board disciplinary actions. Ask: does the firm and the individual partner signing the report appear as licensed in CPAverify, and has the firm's status changed since the engagement letter was signed?
How to verify a SOC 2 claim before you rely on it
This sequence lets procurement confirm, step by step, that a vendor's SOC 2 claim rests on a real CPA-issued report that covers the systems and period the contract needs. Each step ends with a documented yes or no.
Request the signed report and its period
Ask the vendor for the complete SOC 2 report itself, not a badge, a logo or a summary slide. Confirm that it is a Type 1 or Type 2 report, that the auditor's opinion is signed, and that it states either a specific date (Type 1) or a specific observation period (Type 2). A report that states neither cannot support a claim about current controls. The output is a recorded yes or no on whether a signed report with a stated date or period was received. If the vendor offers only a compliance dashboard or a certificate, record a no and stop here, because no SOC 2 certificate exists to verify.
Confirm the issuer is a licensed CPA firm
Check that the report was issued by a certified public accounting firm, not by the compliance tool vendor that prepared the evidence. Search the firm and the individual signing partner in CPAverify, the free license search for CPAs and accounting firms hosted by NASBA and built on official data from 53 participating jurisdictions. The search shows license status and flags state board disciplinary actions. Save the search result with its date. The output is a documented yes or no on whether the signing firm holds a current license in the relevant jurisdiction.
Check the firm's AICPA peer review status
Ask the issuing firm for its most recent AICPA peer review status and report results, then confirm them through the AICPA's public resources. Peer review is a quality review of a firm's accounting and assurance practice, so it is a separate check from the license. Read the result and any letter of comments, and note whether the review covered the firm's attestation work. The output is a documented yes or no on whether the firm is enrolled and has a current review result that you have read. If the firm is not enrolled, record that fact and escalate it to your risk owner.
Compare the report scope to your requirement
Read the system description and the scope section against the contract. Confirm that the named systems, products, services and locations are the ones your data flows through, that the trust services categories beyond security (availability, confidentiality, processing integrity, privacy) are included if your contract needs them, and whether subservice organizations such as cloud hosts are included or carved out. Check the complementary user entity controls section, because your own team may need to operate those controls. The output is a documented yes or no on whether scope covers what you are buying, with any gaps listed.
Test the report date against the contract
Compare the report's date or period end with the date your contract, risk assessment or regulator requires. Ask the vendor what has changed since the period end, such as new systems, acquisitions, platform moves or significant incidents, and request a bridge letter if the gap is material to your review. Record the report's date, the period it covers and the date of the review. The output is a documented yes or no on whether the report is current enough for the contract, with any bridge letter request logged. A bridge letter comes from the vendor's management, not the CPA firm, so it does not replace a new report.
Record the five results in a single file
Place the five documented answers in one vendor file with the report, the CPAverify result, the peer review record, the scope comparison and the date review. Include the reviewer's name and the date of each check. A file with any no answer should go to the risk owner with a decision recorded, either to accept the gap, request remediation or decline the vendor. The output is a complete, dated file that a second reviewer or an auditor can follow without asking the vendor for context.
Why scope and categories decide what your report proves
A SOC 2 report proves only what its system description and scope say it covers. Security is the one category every SOC 2 includes, and it rests on the common criteria CC1 to CC9. Availability, confidentiality, processing integrity and privacy are optional and add criteria only when management includes them. The 2017 Trust Services Criteria contain 61 criteria in total: 33 common criteria, 3 availability criteria (A1), 2 confidentiality criteria (C1), 5 processing integrity criteria (PI1) and 18 privacy criteria (P1 to P8). Before you read a report or sign a customer questionnaire, check which categories were examined. A report that covers security alone says nothing about privacy or processing integrity, even if it is clean.
The points of focus under each criterion are not a checklist. The criteria are outcome-based, and the points of focus are characteristics that can help management design and evaluate controls. Not every point of focus has to be addressed, and an auditor judges whether the controls meet the criterion in the context of your system. Treat the points of focus as design prompts for your control matrix, and ask your CPA firm early which ones it expects you to document for each criterion you include.
What a customer can rely on depends on the system and services named in the description. If the system boundary leaves out a product, a region or a data flow, the report is silent on it. Subservice organizations such as cloud providers may be handled in two ways: included, so their controls are tested as part of your system, or carved out, so their controls are excluded and your description states that they are relied on. A carve-out means a customer must review the provider's own SOC report separately. Confirm with your CPA firm which approach applies, and check whether complementary user entity controls must be documented for your customers to rely on the report.
Questions buyers ask about SOC 2 certification
Is SOC 2 mandatory by law?
No law in the supplied materials requires a SOC 2 report. SOC 2 is a voluntary attestation that customers, banks and partners ask for in contracts and vendor reviews. The demand usually comes from a customer's third-party risk program, a procurement questionnaire or a contract clause. Some regulated customers have their own obligations that push them to request it, so the question to ask is which contract, regulator or customer is asking and what exact report type and scope they expect. A SOC 2 is worth pursuing when a customer requires it, and the requirement itself should be written down before any work starts so the scope matches what the buyer needs.
Can we declare ourselves SOC 2 compliant without an auditor?
No. A SOC 2 is an examination performed by a licensed CPA firm, and only that firm can issue a report expressing an opinion. An organization can describe its own controls and state that it has prepared for a SOC 2, but it cannot certify itself or claim a report it does not hold. The AICPA's guidance warns that the word compliant is not used in SOC 2 examinations, so statements such as SOC 2 certified or compliant in days should prompt questions. Ask any vendor for the CPA firm's name, the report type, the period or date covered, and the report itself under a suitable NDA. Verify the firm's license through CPAverify, a free license search hosted by NASBA.
How long does a SOC 2 report stay current?
A SOC 2 report has no official expiry date, but customers normally treat it as current only for a limited time after its covered period or report date. Most buyers expect a report covering a recent period, and many ask for a bridge letter when the gap between the period's end and today is large. A Type 1 report covers a single date, while a Type 2 covers an observation period, so the age question applies differently to each. Ask the vendor when its next examination period begins, whether controls changed since the last report, and whether a bridge letter is available. A bridge letter is a management statement and does not replace the next report.
Can DeployOpen issue or guarantee a SOC 2 report?
No. DeployOpen is not a CPA firm and does not issue SOC 2 reports, attestations or certifications, and it does not guarantee an outcome. DeployOpen implements, hardens, documents and tests the self-hosted open-source platforms in your own infrastructure, and it can help prepare systems, controls and evidence for the examination. Your organization owns its controls and management assertion, and an independent CPA firm performs the examination and issues the opinion. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.
What does the work need from our team?
Your team owns the decisions and the evidence. Expect to name an accountable owner for each control, define the system and services in scope, approve policies, and run recurring activities such as access reviews, change approvals, vulnerability follow-up and training records. Engineers will need to supply configuration, logs, tickets and infrastructure code in forms the auditor can sample. Management must also sign the written representations the CPA firm requests. Ask any partner which tasks it will carry out and which stay with your staff, because a readiness partner cannot take over management responsibilities or the auditor's independent testing.
What drives the cost and timeline of a SOC 2?
The main cost is the CPA firm's examination fee, which varies with the report type, the categories and systems in scope, and the number of locations and subservice organizations. A Type 2 covers an observation period and therefore usually costs more than a Type 1, which covers a single date. Readiness work, remediation, tooling and internal staff time add further costs, and most of these recur each year. The one published US government estimate in the supplied materials is the Justice Department's proposed rule on sensitive personal data, published in the Federal Register at 89 FR 86116 in October 2024, which is a regulatory estimate rather than a market price. The AICPA warns that vendors promising fast, cheap compliance deserve scrutiny. For a full breakdown see the SOC 2 cost guide and the timeline page, and request a written scope from any provider before comparing quotes.
What to check before you rely on any SOC 2 provider
A SOC 2 report is only as credible as the CPA firm that signs it, and the other providers in the project cannot substitute for that signature. The checks below are questions to put to a CPA firm, a readiness consultant and a compliance tool before any contract is signed, not guarantees about what they will deliver.
Confirm the CPA license
Only a licensed CPA firm can issue a SOC 2 report, so the first question is whether the firm and the individual partner signing the report hold active licenses. Ask for the firm's name and the signing partner's name, then search them in CPAverify, the free license search hosted by NASBA, which shows license status and flags state board disciplinary actions. Record the result in your vendor file before you discuss fees.
Ask for AICPA peer review results
Ask whether the firm takes part in the AICPA Peer Review Program and request the most recent peer review report and its rating. Peer review is an outside check on a firm's accounting and assurance quality, so it tells you more than a sales deck. Confirm that the firm's SOC work falls within the reviewed engagements, since a review of audit work alone may not cover attestation examinations.
Check independence from the tool vendor
Ask whether the firm has a referral, revenue or partnership arrangement with the compliance tool you are considering, and whether the tool vendor selects, pays or steers the auditor. The AICPA has flagged business arrangements with SOC tool providers as an ethics risk, because an auditor who depends on a vendor cannot be seen as independent. Get the answer in writing.
Require a written split of duties
Before signing, get a written statement of who does what: the organization owns its controls and policies, the consultant or tool prepares evidence and gap remediation, and only the CPA firm tests controls and issues the report. Ask whether the same firm would prepare you and attest your controls, because that combination limits independence and should be disclosed. Vague scope language is a reason to pause.
Test any promise of outcomes
The AICPA's ethics guidance treats guaranteeing outcomes, such as a clean audit or a 100% pass rate, as a prohibited practice for auditors. Be cautious of any provider that promises a SOC 2 report in days, a guaranteed clean opinion or a fixed result regardless of your controls. Ask what the provider will do if testing finds exceptions, and whether it will commit to any specific result in its contract.
Verify claims of certification
Ask any provider to explain what it means by SOC 2 certified or compliant, since SOC 2 examinations do not produce a certificate or use the term compliance. A legitimate answer describes a CPA-issued report with an opinion as of a date or over a period. Check that any AICPA logo use matches the logo guidelines, which apply to organizations that hold a SOC report, not to vendors or consultants.
How DeployOpen prepares your systems and evidence for a SOC 2 examination
DeployOpen prepares the systems, controls and evidence that a SOC 2 examination tests, inside your own infrastructure. We do not issue reports or attest to controls, because only an independent CPA firm can do that, so the organization and its auditor remain responsible for the opinion.
How we scope
- Scope is agreed in writing before work starts, covering which systems, environments and Trust Services Categories the examination will include.
- We document the boundary, the hosting accounts and any subservice organizations, so the auditor and your team read the same system definition.
- Engagements are fixed-scope, with deliverables and timelines confirmed in the written scope before any build begins.
How we build
- We configure self-hosted open-source platforms for access control, logging, change management and backups to match your mapped controls.
- Controls are mapped to the 2017 Trust Services Criteria so each criterion has an owner, a procedure and a named evidence source.
- Remediation of gaps found during readiness is done in your environment, with changes recorded so they can be shown to the auditor.
How we hand over
- You receive control documentation, configuration records and an evidence collection schedule that your staff can run after handover.
- We prepare a system description draft for management review, while your leadership remains responsible for its accuracy and sign-off.
- Evidence packages are organized by criterion so your CPA firm can request samples and trace each control without rebuilding the record.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers once the examination is under way or completed.
- Retainers can cover monitoring between audit periods, evidence refreshes and handling of configuration changes during an observation window.
- Questions about what the auditor will accept should go to the CPA firm, and we will help you prepare the answers from your own records.
