Audit report · Building customer trust
Sightadel guides you through the Trust Services Criteria – with industry templates drawn from many years of consulting and certification practice, AI that helps with wording, and real consultants for the difficult parts. The report is issued by an independent audit firm.
What it is about
SOC 2 (System and Organization Controls 2) is an examination framework of the AICPA, the US professional body of certified public accountants. A licensed CPA firm examines whether a service organisation's controls for protecting customer data are suitably designed and operating. The result is not a certificate, but a report that you share with customers under a non-disclosure agreement.
It is based on the 2017 Trust Services Criteria, whose points of focus were revised in 2022. The Security category with the common criteria CC1 to CC9 is always mandatory. You add Availability, Processing Integrity, Confidentiality and Privacy if your service and your customers require it.
Type I describes the design of the controls as at a specific date. Type II confirms that they operated effectively over a period of usually three to twelve months. That is exactly where the work lies: every access review, every change, every onboarding needs dated evidence.
The question about the SOC 2 report is at the top of the security questionnaire. Without it, the sales cycle stretches by weeks, or the deal goes to a competitor.
A large share of the controls is already implemented. What is missing is the mapping to the Trust Services Criteria and an unbroken chain of evidence across the observation period.
The point-in-time date was manageable. For Type II, recurring controls must operate demonstrably for months. Sightadel plans the cycles and reminds you before a date passes.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
Integrity and oversight by management, clear responsibilities, staff competence and defined internal and external communication.
In SightadelTemplates for code of conduct, roles and policies. Acknowledgements and training run as a cycle and are filed as evidence.
Set objectives, assess risks including fraud risks and take changes in the environment into account.
In SightadelRisk register with assessment and treatment, linked to controls and action plans. The annual reassessment is scheduled in the plan.
Select controls, monitor them continuously and report deficiencies promptly to those responsible.
In SightadelThe dashboard shows progress and open items. Identified deficiencies appear under Issues and become measures with a deadline.
Accounts only after approval, strong authentication, regular access reviews, protection of data in transit and at rest.
In SightadelEach control as a guided question with answer options. You plan quarterly access reviews as a cycle, each run with its own evidence.
Detect vulnerabilities and anomalies, evaluate security events, respond to incidents and learn from them.
In SightadelIncidents and follow-up are traceable in the activity log. You link reports from scans and monitoring directly to the control.
Changes to systems and software are requested, reviewed, tested and approved.
In SightadelTemplate for the change procedure. You file samples from your ticketing system as dated evidence – exactly what the auditor will sample.
Prevent business disruption and manage risks from vendors and business partners.
In SightadelThe Vendors module assesses service providers with a questionnaire and risk level. Missing reports from your own vendors are flagged before the auditor asks.
Availability, Processing Integrity, Confidentiality and Privacy – depending on the service and customer expectations.
In SightadelYou choose the scope at the start. Sightadel shows only the relevant controls and records the reasoning for the auditor.
Process
Three to six months to the Type I report, if someone really drives it. For Type II, the observation period comes on top, usually nine to eighteen months in total.
Which system, which criteria beyond Security, Type I or straight to Type II. A lean scope is the fastest route to the first report.
Map existing policies, processes and evidence to the criteria. With ISO 27001 in place, a large part is already there.
Work through all controls step by step. Templates and AI provide drafts; you decide, implement and link evidence.
A preliminary assessment by the audit firm or internally shows which evidence does not yet hold up. After that, the date is set.
The CPA firm examines the design of the controls as at the specified date and issues the first report.
The controls operate in everyday work, and recurring evidence is produced on schedule. At the end, the CPA firm tests samples from the entire period.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
All five categories and the whole company in the first round increase effort and the risk of exceptions. Start with the system your customers use, and with Security.
If an access review from the second quarter is missing, it cannot be made up in the fourth. Set up recurring controls as cycles with a deputy before the observation period begins.
If the policy states a weekly review that only takes place monthly, that is an exception. Write down what you actually do and can sustain.
If cloud providers are carved out, you must obtain and evaluate their reports annually. Schedule this review as a date in vendor management.
Emergency changes without retrospective approval are a common exception. Define the emergency route explicitly and document the retrospective approval.
Auditors reliably find accounts of former staff that are still active days later. Link the HR process to a fixed deadline for revocation and evidence every case.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
Access, changes, incidents, suppliers and risk assessment largely coincide with Annex A. What SOC 2 additionally requires is the unbroken chain of evidence across the observation period.
NIST CSF 2.0Both come from the US. The CSF is suited as a framework for management; SOC 2 provides audited evidence for customers.
GDPRIf you include the Privacy criterion, you can evidence many points with the record of processing activities, deletion concept and data subject processes from the GDPR.
BSI C5:2026Both are attested by independent auditors and know Type I and Type II. For German cloud customers, C5 tends to count more; for US customers, SOC 2.
Audit and evidence
Only a licensed audit firm (CPA firm) may issue a SOC 2 report under the AICPA attestation standards. Sightadel does not audit and does not issue reports. You choose an audit firm from our independent partner network or one of your choice. No commission is paid for audits – neither to us nor to the partners.
The auditors get their own access in Sightadel: controls, answers, comments and evidence with dates and history. They comment, create or edit entries after your approval and never delete anything. The Trust Center shows prospects your frameworks, documents and security posture – you continue to release the report itself in a controlled way under a non-disclosure agreement.
To the independent auditor networkA SOC 2 report has a fixed structure. It starts with the audit firm's opinion. This is followed by management's assertion from the audited company that the system description is accurate and the controls are suitably designed and, for Type II, that they operated effectively. The core is the system description: services, infrastructure, software, people, procedures, data, subservice organisations involved and the relevant controls. The AICPA sets its own description criteria for this.
For Type II, a table follows that maps each criterion to the controls, describes the auditor's tests and states the result. Deviations, known as exceptions, are also listed there, for example if in a sample a leaver was not blocked in time. Individual exceptions do not automatically lead to a qualified opinion, but customers do read them.
Two further sections are important for your customers. Complementary user entity controls describe what the customer must do themselves, such as managing their own access. Complementary subservice organisation controls describe what you rely on at your data centre or cloud provider. These are either included in the examination or carved out. You must monitor carved-out service providers yourself, typically via their own reports.
SOC 2 has two cost blocks. The Sightadel licence is charged monthly per edition, with discounts for multiple frameworks and advance payment. You can find all prices and a calculator on our pricing page.
The audit firm invoices independently. Its fee depends mainly on four factors: the number of criteria beyond Security, the report type, the length of the observation period and the complexity of the system with sites, platforms and subservice organisations involved. Obtain several quotes and clarify in advance whether a readiness assessment is included and how many samples the firm intends to take.
The biggest item is usually internal time. Someone has to write policies, introduce controls, produce evidence on schedule and answer the auditors' questions. In growing software companies, this often falls to one person from engineering or operations who also looks after the product. A clear plan with recurring tasks prevents evidence being recreated in the last month of the observation period. That does not work anyway, because the auditor recognises evidence created after the fact by its date.
Security is always included. You choose the other four categories according to your service and your customers' expectations. Availability fits if customers depend on committed uptime and you can evidence recovery and capacity. Confidentiality fits if you process your customers' confidential business information and make commitments about its protection and deletion. Processing Integrity makes sense if the accuracy of your processing is itself the product, for example for billing or payments. Privacy relates to personal data and is demanding in content.
More criteria mean more audit effort and more surface for exceptions. A lean first report with Security and, where appropriate, Availability is often the smarter start. You can expand in the next audit cycle. Ask your most important customers which criteria they expect before you define the scope.
In Sightadel, you choose the scope at the start. Only the relevant controls appear, and the reasoning for your choice is recorded for the auditor. The basis is the 2017 Trust Services Criteria with the revised points of focus from 2022.
Type II examines whether controls actually operated over a period. The auditor takes samples from the entire period: individual new hires and leavers, changes to the production system, quarterly access reviews, security incidents, vulnerability scans, training records. For every sample, dated evidence must exist.
Most exceptions do not arise from missing controls, but from gaps in the rhythm. The third-quarter access review fell in the holiday season, the new colleague's training was forgotten, a hotfix went live without approval. Every such gap shows up in the report.
It helps to set up all recurring controls as cycles before the period starts, with an owner, a deputy and a due date. Sightadel reminds you before every date and shows on the dashboard which evidence is missing. If the observation period runs to the end of the year, the next one starts directly afterwards so that the follow-up report connects seamlessly. For the time between the end of the report period and the new report, many companies issue a bridge letter to their customers.
Also plan buffers for staff changes. If the person operating a control leaves the company in the middle of the period, the deputy must take over seamlessly. That is why you should define a deputy alongside the owner for every recurring control.
To start, you need a set of policies and procedures: information security, access control, change management, incident response, backup and recovery, risk assessment, vendor management, code of conduct, HR processes for joiners and leavers, encryption and retention. On top of that come an organisation chart, the system description and an overview of the subservice organisations involved.
More important than the policies is the evidence that they are lived. Typical examples are approvals in the ticketing system, records of access reviews, extracts from the HR system, reports from vulnerability scans and monitoring, results of restore tests, training records, signed confidentiality agreements, the risk register and the assessment of vendors including their reports.
In Sightadel, every piece of evidence is attached to the control it proves, with a date and an expiry date. Evidence from ISO 27001 can be assigned to the same SOC 2 control without filing it twice. The auditors get their own access, see answers, comments and history and can comment, but never delete, instead of receiving folders by email.
A note on the system description: it is written by you, not by the auditor. Start early, because it forces you to clarify which components, sites and service providers really belong to the system. Unclear boundaries are a frequent cause of follow-up questions and delays.
For providers with customers on both sides of the Atlantic, the question arises whether one attestation is enough. The answer is usually: largely yes in content, no in form. European customers and tenders ask for ISO 27001, German cloud customers and public sector clients increasingly for BSI C5, US customers for SOC 2.
The difference lies less in the controls than in the type of audit. ISO 27001 assesses a management system and ends with a certificate from an accredited body. SOC 2 and C5 are examinations by independent auditors which, for Type II, confirm effectiveness over a period and deliver a detailed report.
If you maintain the controls properly once and assign every piece of evidence to all matching requirements, you can base several audits on the same foundation. Some audit firms offer combined audits in which samples are used for several reports. Whether that suits your case is something to clarify with the firm. We deliberately do not give a percentage for the overlap; it depends on the scope.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
Checklists and templates for other frameworks are available under Resources.
Practical aids, not legal advice.
Terms
No. SOC 2 is an examination report from a CPA firm. It describes your system, your controls and the test results. You share it with customers under a non-disclosure agreement.
No. ISO 27001 is an international standard with a certificate from an accredited body. SOC 2 is a report under US attestation standards. In content, the two overlap strongly. For European customers, ISO 27001 usually counts; for US customers, usually SOC 2.
Only Security with the common criteria. You add Availability, Processing Integrity, Confidentiality and Privacy if your service and your customers require it. More criteria mean more audit effort.
Type I is faster and good initial evidence. Most customers ultimately want to see Type II. Many start with Type I and begin the Type II observation period immediately afterwards.
Yes. You need an audit firm permitted to issue SOC 2 reports. Many large and mid-sized audit firms also offer this in Germany.
Two items: the Sightadel licence for SOC 2 (prices on our pricing page) and the audit firm, which invoices independently. Its effort depends on the scope, the criteria and the report type. Internal time comes on top.
A Type II report covers a period. Customers usually expect a new report every year that follows on seamlessly. Sightadel keeps the recurring evidence for this on schedule.
No, deliberately not. The AI provides drafts from industry templates and helps with wording. You describe how your controls actually operate yourself – the auditor takes samples and compares.
SOC 1 concerns controls relevant to customers' financial reporting, for example at payroll or billing service providers. SOC 2 concerns security and the other Trust Services Criteria. SOC 3 is a short version of the SOC 2 opinion without detailed tables, which may be shared publicly.
The standard does not prescribe a fixed minimum duration. Three to twelve months is common, often three to six for the first report. Many customers expect follow-up reports to cover twelve months and to connect seamlessly. Agree the duration with the audit firm and your most important customers.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
