How SOC 2 expectations change by industry, where customers' own regulations shape what they ask of a service organization: fintech, healthtech, AI companies, managed service providers, data centers, payroll and HR software, edtech and insurtech.
SOC 2 for fintechs that sell to banks or are themselves regulated: FTC Safeguards Rule duties for non-bank financial companies (MFA, encryption, testing, provider oversight), bank third-party reviews, and when PCI DSS applies alongside SOC 2.
How healthtech vendors use SOC 2 when they are HIPAA business associates: direct Security Rule liability, BAA terms, what a SOC 2 does and does not prove about HIPAA, SOC 2+ with HIPAA criteria, and when customers ask for HITRUST instead.
SOC 2 for companies whose product calls or hosts AI models: model API providers as vendors or subservice organizations, confidentiality of customer data in prompts, logging and evaluation evidence from self-hosted tools, and where ISO 42001 and the EU AI Act come in.
SOC 2 for managed service and managed security providers: what customers and the CISA-led MSP advisory expect (MFA on customer access, log retention, clear responsibilities, account hygiene), NIS2 scope for MSPs, and scoping a multi-customer service.
SOC 2 for data centers and colocation: physical access and asset disposal criteria, availability criteria on environmental protections and recovery testing, what tenants inherit in their own reports, and when a SOC 1 is also requested.
Why payroll, HR and benefits software vendors are often asked for both SOC 1 and SOC 2: customers' financial statement auditors, SOX-related reliance on service organization reports, and privacy criteria for employee personal data.
How edtech vendors use SOC 2 with schools and districts: FERPA's school official exception and direct control, what the Department of Education says schools may ask vendors for, data destruction plans, and the privacy and confidentiality criteria that fit.
SOC 2 for vendors to insurers and insurtechs: the NAIC Insurance Data Security Model Law's third-party oversight duties, the security measures insurers must consider (encryption, MFA, secure development, audit trails), and mapping them to the criteria.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.