Compliance tools · Cybersecurity and data protection

SOC 2 compliance tool

AICPA Trust Services Criteria · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your SOC 2 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

SOC 2 is AICPA Trust Services Criteria, a voluntary standard in the European Union and United Kingdom. Service organisation controls attestation, commonly demanded by B2B software buyers.

The free assessment screens for SOC 2 when a business makes or supplies products or services with digital elements.

Sectors this instrument reaches: SaaS providers; cloud computing services; data centres; managed service providers; technology service providers.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under SOC 2: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that SOC 2 applies to your business, free →

Does SOC 2 apply to my business?

SOC 2 applies to you if you are a service organisation that stores, processes, or transmits customer data on behalf of user entities, such as a SaaS provider, cloud hosting firm, data centre, or managed service provider (AICPA TSP Section 100 / AT-C Section 320). It is a voluntary assurance standard, so no law forces you to obtain a report.

Who does SOC 2 apply to?

It applies to service organisations, meaning entities that store, process, or transmit customer data on behalf of user entities, primarily technology and cloud-computing companies, SaaS providers, data centres, managed service providers, and third-party service providers relevant to user entities' internal controls (AICPA TSP Section 100 / AT-C Section 320). User entities themselves are not subject to SOC 2 obligations.

Does SOC 2 apply to a small business?

SOC 2 has no size threshold, no exemption and no relief based on employee numbers or turnover. The cost and effort of an engagement scale with the complexity of the system in scope, making it accessible to smaller organisations with well-defined system boundaries.

When does SOC 2 apply from, and what are the deadlines?

SOC 2 has no fixed regulatory reporting calendar. Type I reports may be obtained at any point in time (AT-C Section 205), Type II reports cover a review period of typically 6 to 12 months, and annual renewal is the standard practice, with the new review period beginning the day after the prior one ends (AT-C Section 205 / AICPA SOC 2 Guide).

What does SOC 2 require me to do?

You must address all Common Criteria CC1 through CC9 in every engagement, covering control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management, and risk mitigation. You must also prepare a written system description and signed management assertion and engage a licensed CPA firm.

What records or documents does SOC 2 require me to keep or produce?

You must prepare a written system description covering the system boundaries, services, principal service commitments and system requirements, and the controls designed to meet the applicable criteria (AICPA TSP Section 100 / AT-C Section 320). Management must also prepare and sign a written assertion on the fairness of that description and the suitability and effectiveness of controls (AT-C Section 320).

What happens if I do not comply with SOC 2?

Non-compliance does not result in statutory fines or regulatory sanctions from the AICPA or any government body, because SOC 2 is voluntary. The consequences are commercial: loss of customer contracts where SOC 2 is a contractual prerequisite, inability to enter enterprise procurement, reputational damage, breach of contract liability, and failure to obtain or renew cyber insurance that requires SOC 2.

Does SOC 2 apply to a UK business selling into the EU?

SOC 2 has no geographic restriction, so a UK business selling into the EU may obtain a report. Any service organisation, regardless of its jurisdiction of incorporation, may obtain a SOC 2 report, and enterprise customers across North America, Europe, Asia-Pacific and other regions routinely require them.

Does SOC 2 apply to an EU business selling into the UK?

SOC 2 has no geographic restriction, so an EU business selling into the UK may obtain a report. Any service organisation, regardless of its jurisdiction of incorporation, may obtain a SOC 2 report, and it is adopted worldwide as a de facto standard for service organisation assurance.

How is SOC 2 different from PCI DSS?

PCI DSS is mandatory for organisations that store, process, or transmit cardholder data, while SOC 2 is voluntary. The two programmes can share control evidence in access management, encryption, vulnerability management and monitoring, but they require separate assessments.

How do I start complying with SOC 2?

The first practical step is to prepare the written system description and the signed management assertion, which set out the system boundaries, the services provided, the principal service commitments and system requirements, and the controls designed to meet the applicable criteria (AICPA TSP Section 100 / AT-C Section 320).

Which ComplianceSME account includes the SOC 2 toolkit?

The SOC 2 agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive