SOC 2 guide · Indian SaaS
Your first US customer asked for SOC 2. Here is what that actually means.
SOC 2 is the security report North American enterprise buyers ask SaaS vendors for, and it is widely misunderstood — including by some of the people selling it. This guide separates what the AICPA actually says from market habit, tells you who may sign your report and how to check them, and lays out a route an Indian startup can run without stalling the product.
Reviewed 6 November 2026 · 9 sources cited
The short answer
SOC 2 is an attestation report, not a certificate: a licensed, independent CPA firm examines your controls against the AICPA’s Trust Services Criteria and gives an opinion. For an Indian SaaS startup selling to US enterprises, the report buyers usually mean is Type II — controls operating over a period. Start with readiness and evidence collection, choose and check a CPA firm early, and remember the DPDP Act still applies separately.
Start here
A report with an opinion in it, signed by a CPA firm.
SOC 2 is one of the AICPA’s “System and Organization Controls” services — a suite, in the AICPA’s words, of offerings CPAs may provide. In a SOC 2 examination a CPA firm tests your controls against the Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy, and writes an opinion. The criteria in use today are the 2017 Trust Services Criteria, with points of focus revised in 2022.
Two consequences matter to a founder. First, there is no certificate and no such thing as being “SOC 2 certified”: your customer will ask for the report itself, under NDA, and check who signed it. Second, only a licensed, independent CPA can sign it. A consultancy can get you ready and a platform can organise your evidence, but neither can issue the report.
The scope is narrower than people fear. The common criteria — which make up the whole Security category — apply to every SOC 2. Availability, processing integrity, confidentiality and privacy each add their own criteria, and belong in scope only when your product or contracts make those promises.
For an Indian startup the trigger is usually commercial: a US enterprise prospect, a procurement questionnaire, a deal waiting on a report. That is a good reason to do it — and a reason to do it properly, because the report is read by security teams who know what a thin one looks like. Our SOC 2 service describes how we run the readiness work.
The two report types
Type I or Type II — what each one tells a buyer
The AICPA’s criteria describe a type 2 engagement as covering operating effectiveness “throughout a specified period”. They do not fix the length; the norms below marked as convention are market practice, not rules.
| Type I | Type II | |
|---|---|---|
| What the opinion covers | Whether controls are suitably designed, at one date | Design and whether controls operated effectively throughout a period |
| Tests of controls in the report | — | ✓ — the auditor’s tests and results are described |
| Period | A single date | A specified period; three to twelve months is convention, six common for a first report |
| What buyers make of it | A start; many security teams treat it as interim | The report most enterprise buyers mean when they say “SOC 2” |
| When it earns its place | A deal cannot wait for a Type II window to run | Always the destination |
If a deal is waiting, a Type I can unblock it while the Type II period runs — but start the Type II period at the same time, or you will be explaining the same gap again in six months.
Choosing the auditor
Who can issue a SOC 2 for an Indian company — and how to check them
The CPA firm does not need to be in India; much SOC 2 work for Indian companies is done remotely. What matters is that the firm is licensed, independent and doing a real examination.
| Who | Can they issue your SOC 2? | How to check |
|---|---|---|
| A licensed US CPA firm, often working remotely | Yes. SOC 2 examinations are performed by licensed, independent CPAs under AICPA attestation standards | Look the firm up on CPAverify, NASBA’s public search; ask about its peer review; ask for a redacted sample report |
| A non-US accountancy firm offering a report under the international assurance standard ISAE 3000, using the same criteria | Contested. It may follow the same criteria under a different standard; whether your customer accepts it is your customer’s decision | Ask the customer before you sign, and ask the firm exactly which standard its opinion is given under |
| A compliance automation platform | No. It organises evidence; it does not give an opinion | Ask which CPA firm will sign, and check that firm |
| A readiness consultancy, including SemperWise | No | We design controls and evidence; you appoint the CPA firm directly |
Two AICPA signals from 2026 are worth knowing. Its Peer Review Board told reviewers that SOC 2 engagements with identical reports, risk assessments, sample sizes and testing procedures across clients are not performed to professional standards, and to look hard at unreasonable engagement timelines and over-reliance on SOC platforms. And the AICPA has said it is looking into allegations about a compliance vendor offering SOC services, and refers unlicensed firms to state boards.
What founders are told
Six things you will hear about SOC 2
What people assume“We need to get SOC 2 certified.”
What is actually trueThere is no SOC 2 certificate. There is a report containing a CPA firm’s opinion, valid for the period it covers. A website that says “SOC 2 certified” tells a buyer’s security team something about the vendor before the review has started.
What people assume“The platform gives us SOC 2.”
What is actually truePlatforms collect evidence, and that is useful. The examination and opinion come from a licensed CPA firm, which must tailor the work to your risks — the AICPA’s Peer Review Board said in 2026 that identical, templated engagements do not meet professional standards.
What people assume“Faster is better — get the audit done in a fortnight.”
What is actually trueThe AICPA now asks peer reviewers to examine whether SOC 2 engagement timelines are reasonable. A report your customer’s security team does not trust has cost you the deal and the fee.
What people assume“Include all five categories, to be safe.”
What is actually trueSecurity, through the common criteria, is in every SOC 2. Add availability, confidentiality, processing integrity or privacy only where your product or contracts make that promise — each one adds work every year.
What people assume“Type I is what enterprises want.”
What is actually trueA Type I says controls were designed properly on one date. Most enterprise buyers mean Type II; treat Type I as a bridge, not a destination.
What people assume“SOC 2 covers our Indian legal obligations.”
What is actually trueIt is a US attestation framework. The DPDP Act imposes its own duties on Indian companies, from about May 2027, and no report discharges them.
Two frameworks, one set of controls
SOC 2 and ISO 27001 for an Indian SaaS company
Many Indian SaaS companies end up with both: SOC 2 for US buyers, ISO 27001 for Indian, European and Middle Eastern buyers and tenders. Build the controls once and evidence both.
| SOC 2 | ISO/IEC 27001 | |
|---|---|---|
| What you receive | A report with a CPA firm’s opinion and, in Type II, its tests | A certificate from an accredited certification body |
| Who issues it | A licensed, independent CPA firm | An accredited certification body — in India, accredited by NABCB or another accreditation body |
| What is examined | Your controls against the Trust Services Criteria | Your management system (clauses 4 to 10) and the Annex A controls you apply |
| How buyers check it | They read the report, shared under NDA | They check the certificate with the issuing body |
| Rhythm | A new report for each period; yearly by convention | A three-year certificate with yearly surveillance audits |
| Shared work | Access control, change management, risk assessment, vendor management, incident response, logging | The same — mapped once, evidenced once |
Budgeting the ISO side too? Our ISO 27001 cost guide breaks down every line, and the unified control model is how one control evidences both frameworks.
A route a startup can run
From “send us your SOC 2” to a Type II report
Durations are typical for a startup of ten to a hundred people on a cloud platform, not promises. The period is calendar time: it cannot be compressed by working harder in the final fortnight.
-
Weeks 0–2
Decide what you are buying
- Ask the customer what they need: Type I or Type II, and which categories
- Draw the system boundary — product, infrastructure, people, key vendors
- Shortlist CPA firms and check each one on CPAverify
-
Months 1–3
Readiness and remediation
- Gap assessment against the common criteria, plus any extra categories in scope
- Multi-factor login everywhere, joiner-mover-leaver process, quarterly access reviews
- Changes through reviewed pull requests, logging and alerting, a vendor list with reviews
- Risk assessment, incident response plan and policies that describe what you actually do
- A penetration test of the product, with fixes verified
-
If a deal is waiting
Type I
- A point-in-time report on design, while the Type II period starts in parallel
-
Months 3–9
The Type II period
- Controls operate; evidence is collected as it happens, not rebuilt later
- Drift caught and fixed early, while it is still cheap
-
After the period
Fieldwork and report
- The CPA firm samples evidence and tests controls; exceptions are discussed
- Report issued; share it under NDA, and summarise it on a trust page
-
Every year
Keep it current
- The next period starts where the last one ended
- Add ISO 27001 when Indian or European buyers ask, and plan for DPDP duties from about May 2027
Readiness checklist
Fourteen things an auditor will want to see
Tick only what you could show with evidence today — a screenshot, a ticket, a log — not what you intend to do.
Dates to plan around
The criteria, the proposed 2027 update and DPDP
-
Today
2017 Trust Services Criteria, points of focus revised in 2022 In force now
The criteria current SOC 2 examinations are performed against.
-
13 Nov 2025
DPDP Rules notified
Most duties — security safeguards, breach reporting with a detailed report to the Board within 72 hours — come into force eighteen months later.
-
26 Oct 2026
Proposed 2027 criteria published
The AICPA exposed revised Trust Services Criteria and description criteria for comment, with new points of focus on AI governance, model monitoring, prompt manipulation, data poisoning and training data.
-
15 Jan 2027
Comment period closes Coming
The proposals may change before they are final.
-
About May 2027
DPDP duties apply Coming
A SaaS company processing personal data for customers is usually their Data Processor; its own users’ and employees’ data makes it a Data Fiduciary. Both need contracts and safeguards in place.
-
31 Dec 2027
Proposed effective date Coming
If approved, the new criteria apply to engagements beginning on or after this date, with early adoption permitted. A first report started in 2027 is likely to use today’s criteria — confirm with your CPA firm.
The 2027 criteria are a proposal until the AICPA finalises them. DPDP dates are from the DPDP Rules, 2025; see our DPDP readiness assessment. General information, not legal advice.
Next step
Get a fixed quote for SOC 2 readiness.
Tell us who asked for the report and what your product runs on. We reply to arrange a 30-minute scoping call — no charge — then send a written scope and a fixed price for readiness.
You appoint and pay the CPA firm directly. We will help you check the firms on your shortlist and work alongside the one you choose.
- Which Trust Services categories you actually need, with the reasoning
- Whether a Type I is worth it for your deal, or only a cost
- A gap list against the common criteria, each gap with an owner
- A fixed price for readiness, with what your team must do stated plainly
We reply within one business day. SemperWise is not a CPA firm and does not issue SOC 2 reports.
Thank you
Your enquiry has reached us. A member of the SemperWise team will get back to you within 24 business hours.
If it is urgent, call +91-95851-60363.
Where SemperWise fits
Readiness for the report, and evidence that keeps flowing
Services are people doing the work; SemperWise One is the platform that keeps evidence current. Each row says which.
“A customer asked for our SOC 2 report.”
Scoping, gap assessment, control design and remediation against the criteria you actually need — then liaison with your CPA firm through fieldwork.
SOC 2 readiness“The period has started and evidence is a mess.”
Evidence Collection stores each artefact with its collection date and expiry, and Continuous Controls Monitoring flags drift during the period.
SemperWise One“We need SOC 2 now and ISO 27001 next year.”
One control set mapped across both, so each control is implemented and evidenced once.
Unified control model“Questionnaires keep arriving while we wait.”
Answers drafted from evidence you already hold, kept in a library that retires them when the evidence expires.
Questionnaire automation“The auditor and the customer want a pentest.”
Product testing with every finding confirmed by a person, and a retest of your fixes included.
Penetration testing“What does DPDP mean for us as a processor?”
A fixed-scope assessment of your DPDP role for each kind of data, the contracts you need and the safeguards the Rules require.
DPDP readiness“Selling to enterprises across markets.”
How SOC 2, ISO 27001, questionnaires and trust pages fit together for a SaaS company — see our page for SaaS teams.
SaaS security and complianceQuestions
What founders ask about next.
The follow-up questions this subject raises, answered in full.
Is SOC 2 mandatory for Indian SaaS companies?
No law in India requires it. SOC 2 is a commercial requirement: North American enterprise buyers, and many global ones, ask SaaS vendors for a SOC 2 report before signing. Indian buyers and tenders more often ask for ISO 27001. What is law is the DPDP Act, whose main duties apply from about May 2027, and CERT-In’s incident-reporting directions. So treat SOC 2 as a sales asset with a real cost, and do it when a pipeline needs it — not because a platform’s marketing says every startup should. See SOC 2 for how the readiness work runs.
Should we get a SOC 2 Type 1 or Type 2 report?
Type 2, in the end. A Type 1 report gives an opinion on whether controls were suitably designed at one date; a Type 2 report also covers whether they operated effectively throughout a period, and describes the auditor’s tests. Most enterprise security teams mean Type 2 when they ask for SOC 2. A Type 1 earns its place when a deal cannot wait for a Type 2 period to run — get it, but start the Type 2 period at the same time, so you are not explaining the same gap again later.
How long does SOC 2 take for a startup?
Typically a few months of readiness, then the Type 2 period, then fieldwork and the report. The AICPA’s criteria describe a type 2 engagement as covering “a specified period” without fixing its length; three to twelve months is market convention, with six common for a first report. The period is calendar time and cannot be compressed. Be wary of very short timelines: in 2026 the AICPA asked its peer reviewers to look at whether SOC 2 engagement timelines are reasonable. The fastest honest route is readiness done properly before the period starts.
Who can be our SOC 2 auditor in India?
A licensed, independent CPA firm — the AICPA says SOC 2 examinations are performed by licensed CPAs under its attestation standards. The firm need not be in India; many US firms examine Indian companies remotely. Check the firm on CPAverify, NASBA’s public search, ask about its peer review, and ask for a redacted sample report. If you are offered a report from a non-US firm under the international standard ISAE 3000, ask your customer whether they will accept it before you sign. SemperWise is not a CPA firm and does not issue reports.
Should we do SOC 2 or ISO 27001 first?
Follow your pipeline. US enterprise buyers usually ask for SOC 2; Indian, European and Middle Eastern buyers and tenders usually ask for ISO 27001. If both are coming, the controls overlap heavily — access, change management, risk, vendors, incident response — so build them once and map the evidence to both. ISO 27001 adds a management system and a certificate with yearly surveillance; SOC 2 adds a report renewed for each period. Our ISO 27001 cost guide shows what the certification side involves.
What is a SOC 2 bridge letter?
A letter, by convention written by your own management rather than by the CPA firm, that covers the gap between the end of your last SOC 2 period and today. It states that no significant changes to the system or controls have occurred since the report period ended, or describes those that have. It carries no audit opinion, so buyers accept it only for a limited gap — usually until your next report arrives. Keep your periods back to back and the gap stays short enough for a bridge letter to be credible.
Does SOC 2 make us DPDP compliant?
No. SOC 2 is a US attestation framework; the Digital Personal Data Protection Act is Indian law. A SaaS company processing personal data for its customers is usually their Data Processor, and a Data Fiduciary for its own users’ and employees’ data. From about May 2027 the DPDP Rules require reasonable security safeguards and, for fiduciaries, breach reporting with a detailed report to the Board within 72 hours. Good SOC 2 controls help with the safeguards; they do not provide the contracts, notices or breach process. A DPDP readiness assessment sizes that work.
What changes with the 2027 Trust Services Criteria?
In October 2026 the AICPA published proposed revisions to the Trust Services Criteria and description criteria for comment until 15 January 2027. If approved, they apply to engagements beginning on or after 31 December 2027, with early adoption permitted. The proposals restructure the criteria and add points of focus on AI — governance, model monitoring, prompt manipulation, data poisoning and training data. A first report started in 2027 will most likely use today’s criteria; ask your CPA firm. If your product uses AI, expect those questions either way.
Sources
Checked by our research desk on 6 November 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
- System and Organization Controls: SOC suite of services (including AICPA notice on SOC services) — AICPA & CIMA
- 2017 Trust Services Criteria (With Revised Points of Focus – 2022) — AICPA & CIMA
- 2017 Trust Services Criteria — introduction, common criteria and type 2 engagements (text of the AICPA document) — AICPA; copy hosted by Arpio
- AICPA proposes improvements to SOC 2 trust services criteria — Journal of Accountancy (AICPA), 28 October 2026
- CPAverify — public search of CPAs and CPA firms — NASBA
- AICPA guides peer reviewers to address SOC 2 risks — Journal of Accountancy (AICPA), 14 May 2026
- Digital Personal Data Protection Act, 2023 — MeitY
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) — MeitY, 13 November 2025
- AICPA exposure drafts: proposed 2027 SOC 2 Trust Services Criteria and description criteria — AICPA & CIMA, 26 October 2026
Next step
Get to the observation window with evidence already flowing.
A 30-minute scoping call, no charge. You leave knowing which criteria you need, whether a Type I is worth it, and a fixed price for readiness. The report itself comes from a licensed CPA firm you appoint.