What's the difference between SOC 2 Type 1 and Type 2?

A Type 1 report evaluates whether your controls are properly designed at a single point in time; a Type 2 report evaluates whether those controls actually operated effectively over an extended observation period, typically 3–12 months.

Do we need to complete a Type 1 audit before a Type 2?

No — Type 1 isn't a prerequisite, though many organizations use it as a starting point to validate control design before committing to the longer Type 2 observation period.

What are the five SOC 2 Trust Services Criteria?

The five criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy — Security is required for every SOC 2 report, while the other four are included based on what your organization commits to its customers.

What is a SOC 2 readiness assessment, and do we need one?

A readiness assessment is a pre-audit gap analysis comparing your current controls against SOC 2 requirements, so gaps can be remediated before your formal audit — most organizations benefit from one, since it prevents costly findings during the actual examination.

How long does SOC 2 preparation take?

A readiness assessment typically takes several weeks, remediation of identified gaps commonly takes 2–4 months, and a Type 2 observation period adds another 3–12 months before the audit itself can begin.

Is SOC 2 a certification?

No — SOC 2 is an attestation report issued by a licensed CPA firm describing your controls and their effectiveness, not a certification or pass/fail credential, though it's commonly treated as proof of security maturity by customers and partners.

Who performs the actual SOC 2 audit?

SOC 2 audits must be performed by a licensed CPA firm; BorderHawk provides readiness consulting and control design ahead of that engagement but does not issue the final SOC 2 report itself.

What are the most common gaps organizations have before a SOC 2 audit?

The most frequent gaps are missing formal information security policies, incomplete access reviews, no documented risk assessment process, and insufficient change management or security monitoring evidence.

Do we need SOC 2 if we're not selling software?

SOC 2 is most common among SaaS and technology vendors, but any organization that stores or processes customer data on behalf of clients — including managed service providers and data centers — may be asked for a SOC 2 report during vendor due diligence.

Can BorderHawk help with both SOC 2 and PCI DSS at the same time?

Yes — many organizations pursuing SOC 2 also carry PCI DSS scope, and BorderHawk builds shared control documentation where the two frameworks overlap to reduce duplicate effort.

SOC 2 Compliance Consulting

Meet Your SOC 2 Compliance Requirements

We work with organizations in critical sectors and various infrastructure nationwide to interface with SOC auditors, aid in preparation for audits, and maintain readiness between audits. Our information risk and cybersecurity services align your internal process and leadership's expectations with SOC requirements.

SOC Requirements

System and Organization Controls (SOC) reports are a suite of auditing frameworks developed by the American Institute of Certified Public Accountants (AICPA) to help service organizations demonstrate the effectiveness of their internal controls. These reports are especially important for organizations that manage sensitive data or perform critical services on behalf of clients. SOC reports provide assurance to stakeholders—such as customers, regulators, and auditors—that the organization is managing risks appropriately and operating securely and reliably, and are often directly related to acquiring contracts. Additionally, many SOC 2 clients also carry PCI scope, making overlapping control alignment essential for streamlining compliance across both frameworks.

SOC 1 Report

SOC 1 reports focus on Internal Controls over Financial Reporting (ICFR). They are designed for service organizations whose services could impact a client's financial statements. These reports evaluate how well the organization's controls support the accuracy and integrity of financial data processing, making them essential for entities like payroll processes, claims administrators, and financial transaction handlers.

The purpose of a SOC 1 report is to provide assurance to the user entity's financial auditors that the service organization's controls are suitably designed (Type 1) and, in some cases, operating effectively over time (Type 2). This helps reduce the scope of financial audits for clients and ensures that outsourced services do not compromise financial reporting accuracy.

SOC 1 reports are primarily used by financial auditors, CFOs, and accounting teams of client organizations. These stakeholders rely on SOC 1 reports to assess the reliability of financial dat processes by third-party vendors and to support their own internal and external audit requirements.

SOC 2 Type 1 Report

SOC 2 Type 1 reports evaluate the design of a service organization's controls related to the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. A Type 1 report provides a snapshot of the controls in place at a specific point in time and assesses whether they are suitability designed to meet the stated criteria.

The purpose of a SOC 2Type 1 report is to demonstrate that an organization has thoughtfully designed controls to manage risks related to data protection and system reliability. It is often used as a starting point for organizations building out their compliance programs or preparing for more rigorous assessments like SOC 2 Type 2.

SOC 2 Type 1 reports are typically shared with prospective clients, partners, and internal stakeholders who want assurance that the organization has a solid foundation of security and compliance controls. These reports are often used during vendor evaluations or procurement processes.

SOC 2 Type 2 Report

SOC 2 Type 2 reports go a step further by evaluating not only the design but also the operational effectiveness of controls over a defined period - usually 3 to 12 months. This type of report provides a more comprehensive view of how consistently and reliably the organization applies its controls in practice.

The purpose of a SOC 2 Type 2 report is to offer a higher level of assurance that the organization's controls are not only well-designed but also functioning effectively over time. This is critical for organizations that handle sensitive customer data or provide mission-critical services, as it demonstrates long-term reliability and trustworthiness.

SOC 2 Type 2 reports are intended for customers, regulators, and business partners who required strong evidence of operational security and compliance. These reports are often a prerequisite for doing business in regulated industries or with enterprise clients that demand rigorous third-party assurance.

SOC 3 Report

SOC 3 reports are similar in scope to SOC 2 but are designed for general public consumption. They provide a high-level summary of the organization's adherence to the Trust Services Criteria without disclosing sensitive details about specific controls or test results.

The purpose of a SOC 3 report is to publicly demonstrate an organization's commitment to security, availability, and privacy. It serves as a marketing and trust-building tool, allowing companies to showcase their compliance posture without revealing proprietary or confidential information.

SOC 3 reports are aimed at a broad audience, including customers, investors, and the general public. They are often published on company websites or included in marketing materials to build confidence in the organization's security and compliance practices.

Community

The BorderHawk Community, composed of security and compliance professional, offers strategic value to leadership and risk management teams. Within the community, leaders gain access to real-time insights on emerging threats, regulatory updates, and proven mitigation strategies - shared by BorderHawk experts and peers who face similar challenges.

This collective intelligence accelerates decision-making, enhances incident response readiness, and fosters a culture of continuous improvement. For compliance officers and CISOs, the ability to benchmark practices, validate interpretations of complex regulations, and source solutions to nuanced problems reduces isolation and increases confidence in their programs.

Ultimately, the BorderHawk community strengthens organizational resilience and ensures that security and compliance efforts are both proactive and aligned with industry best practices.

Risk Assessment

Risk assessments are essential for any organization aiming to maintain strong security and compliance postures. They provide a structured approach to identifying vulnerabilities, evaluating potential threats, and understanding the impact of security incidents on sensitive information.

By regularly conducting risk assessments, organizations can prioritize resources effectively, implement targeted safeguards, and demonstrate due diligence in meeting their regulatory, contractual, and internal requirements. Risk assessments not only reduce the likelihood of data breaches and compliance violations, but also build trust with patients, partners, and regulators by showing a proactive commitment to protecting sensitive information.

In a rapidly evolving threat landscape, risk assessments are not just a regulatory checkbox - they are a strategic necessity.

Overwatch Compliance Framework

A detailed compliance framework is critical for organization to navigate the complex landscape of regulatory and contractual mandates. Such a framework provides a structured, repeatable approach to managing policies, processes, incident response, and security controls - ensuring that every aspect of compliance is addressed systematically.

The rigor the Overwatch Framework brings helps eliminate gaps, reduce human error, and align internal practices with external expectations. Moreover, a well-documented framework enhances accountability, simplifies audits, and enables faster adaptation to regulatory changes.

The Overwatch Framework transforms compliance from a reactive obligation into a proactive, strategic asset that supports operational excellence and builds stakeholder trust.