Framework · Service organisation attestation
SOC 2
The AICPA attestation framework for service organisations, evaluating controls against five Trust Service Criteria.
SOC 2 is in scope at Goldline. It is the report a US customer asks for where a UK customer would ask for ISO 27001, and the two share most of their controls, so a company facing both builds one system and evidences it twice. Goldline does the readiness, the control design, the evidence and the auditor liaison; a licensed CPA firm does the examination and issues the report. Goldline never both prepares and examines.
See SOC 2 readinessWHERE THIS FRAMEWORK FITS
Where this framework fits at Goldline
SOC 2 is a Goldline service: readiness, control design, evidence and liaison with the CPA firm, which carries out the examination and issues the report. Companies that also need ISO 27001 run both on one control set. Scoped on the diagnostic.
Book the Free DiagnosticWhat is SOC 2?
SOC 2 is an attestation framework developed by the American Institute of Certified Public Accountants (AICPA) for service organisations. Unlike a certification, SOC 2 produces an independent attestation report from a licensed CPA firm evaluating controls against five Trust Service Criteria: Security, Availability, Confidentiality, Processing Integrity, and Privacy. The Security criterion is mandatory; others are selected based on customer commitments. SOC 2 reports come in two types: Type 1 evaluates control design at a point in time; Type 2 evaluates operating effectiveness over an observation period of 3 to 12 months.
What SOC 2 covers
SOC 2 reports evaluate the design and operating effectiveness of controls relevant to the Trust Service Criteria selected for the engagement.
Security (Common Criteria)
The mandatory Trust Service Criterion. Protection against unauthorised access, both physical and logical.
Confidentiality
Information designated as confidential is protected from unauthorised disclosure across its lifecycle.
Availability
Systems are available for operation and use as committed in service-level agreements.
Processing integrity
System processing is complete, valid, accurate, timely, and authorised.
Privacy
Personal information is collected, used, retained, disclosed, and disposed of in conformity with privacy commitments.
Type 1 vs Type 2
Type 1: control design at a point in time. Type 2: operating effectiveness over a 3-12 month observation period.
When a UK company needs SOC 2
When a customer names a SOC 2 report in a contract or security questionnaire. An ISO 27001 certificate does not answer that request, and the reverse is also true.
A customer's contract or security questionnaire names a SOC 2 report. That request is answered by the report, not by another certificate.
SOC 2 is a US attestation issued under the standards of the AICPA, the US accountancy body. ISO 27001 is an international certification. The customer's request decides which is needed.
Much of the control work is shared with ISO 27001: access, change, suppliers, incidents and risk. One system can serve both, built once and evidenced for each.
SOC 2 attestation is issued by a licensed CPA firm under AICPA professional standards, providing independent assurance.
A Type 2 report covers whether controls operated effectively over a review period the company agrees with the CPA firm, usually three to twelve months.
Goldline prepares the company; a licensed CPA firm the company appoints carries out the examination and issues the report. Goldline never both prepares and examines.
METHODOLOGY
How Goldline delivers SOC 2 readiness
Our approach to SOC 2 implementation. Seven phases from Trust Services Criteria selection through ongoing compliance maintenance, calibrated to organisations facing enterprise procurement gates and ongoing audit cycles.
- 01
Phase 1
Trust Services Criteria and scope selection
Senior practitioner-led scoping determines the purpose of the SOC 2 report and selects applicable Trust Services Criteria. Security is mandatory. Confidentiality, Availability, Processing Integrity, and Privacy added based on the data and services in scope. Type 1 versus Type 2 decision finalised.
- TSC selection
- Scope memorandum
- Type 1 or Type 2
- 02
Phase 2
Gap analysis and remediation plan
Senior practitioner gap analysis examines current practices against SOC 2 best practices. Identifies where security posture meets criteria and where remediation is required. Strategic remediation plan structured to address gaps in the most efficient path possible.
- Gap analysis
- Remediation plan
- Effort estimation
- 03
Phase 3
Stage-appropriate control design
Controls calibrated to organisational stage and risk profile. Enterprises and startups require different controls to demonstrate SOC 2 adherence. From logging and monitoring through HR processes and vendor management, the senior practitioner identifies which tools and processes deliver evidence efficiently.
- Control framework
- Tool selection
- Process design
- 04
Phase 4
Control implementation and risk assessment
Technical and operational controls implemented across the selected criteria. Risk assessment performed once controls are approximately 80 percent constructed. Risks identified through growth, geography, or operational change are documented with treatment or acceptance.
- Controls operational
- Risk register
- Treatment plan
- 05
Phase 5
Evidence collection and audit preparation
Evidence of implemented controls gathered and structured against the auditor's request list. Internal team prepared to answer auditor questions. Auditor identified and engaged. GRC platform configured for continuous evidence capture and audit-ready presentation.
- Evidence pack
- Auditor selection
- Walkthroughs prepared
- 06
Phase 6
Audit execution
SOC 2 audit performed by independent licensed CPA firm. Senior practitioner remains accountable through audit completion. Exceptions identified are remediated prior to report issuance.
- Audit fieldwork
- Exception remediation
- Report drafting
- 07
Phase 7
Continuous compliance and annual cycle
SOC 2 audits are performed annually. GRC platform integrations established during implementation collect evidence automatically and monitor practices continuously. This avoids heavy time commitments from operational teams and maintains audit-ready posture through each subsequent annual cycle.
- Continuous evidence
- Annual cycle
- Audit readiness
SOC 2 vs ISO 27001 vs ISO 42001
The three frameworks UK SaaS organisations most commonly evaluate alongside SOC 2.
| SOC 2 | ISO 27001 | ISO 42001 | |
|---|---|---|---|
| Type | AICPA attestation framework. US-developed. | International ISO/IEC standard. | International AI Management System standard. |
| Scope | Five Trust Service Criteria; Security mandatory. | Risk-based ISMS with 93 Annex A controls. | Annex B AI-specific controls and lifecycle governance. |
| Cycle | Annual attestation report from licensed CPA firm. | Three-year certification cycle with annual surveillance. | Three-year certification cycle. |
| Recognition | Requested where a customer's contract or questionnaire names a SOC 2 report. | Globally recognised across procurement, regulatory, and investor audiences. | Certificate from an accredited certification body that the AI management system conforms to the standard. |
Why Goldline
Senior practitioner-led delivery
Founder-engaged across every engagement. Around fifteen years delivering in UK defence, government and regulated programmes. Active credentials maintained against the standards in scope.
Audit-grade evidence, contract-grade outcome
Implementation produces the board-ready governance and audit continuity that customers, investors, and prime contractors expect.
UK regulatory and defence depth
ISO 27001, ISO 42001, SOC 2, GDPR, Cyber Essentials Plus, Defence Cyber Certification (DCC). Quarterly horizon scanning across FCA, DORA, NIS 2, the Information Commission (formerly the Information Commissioner's Office, ICO), and Defence Cyber Certification.
Fixed-scope, fixed-fee model
Productised engagements with transparent inclusions. No timesheet billing, no scope drift. The sequence is fixed. Your timeline is set at the free diagnostic.
What it costs
Scoped on the diagnostic. The CPA firm's examination fee is paid direct to the firm. Runs on your compliance platform if you have one, or in our UK-hosted GRC workspace at no extra subscription.
Scoped on the diagnosticAfter SOC 2: keeping it running
Certification is an operating obligation, not an endpoint. Three packages on a 12-month term, billed monthly, keep the controls running and the evidence current, from £495 a month plus VAT, with the checking done by people independent of the people doing the work.
Frequently asked
Discuss where this framework fits your programme
Book the Free Diagnostic to discuss the SOC 2 scope, the evidence already in place and the route to an independent CPA firm's examination.