SOC 2
A US attestation report on the controls a service organisation runs, most often requested by enterprise customers during procurement.
NUEXUS delivers readiness, gap assessment, implementation support and evidence preparation. NUEXUS is not an accredited certification body and not an auditor, and cannot certify you, issue an attestation, or sign off on a result.
How it is organised
It is a report, not a certificate
SOC 2 produces an attestation report written by a licensed CPA firm. There is no certificate and no logo you have passed. What you hand a customer is the report itself, and sophisticated customers read it rather than filing it.
Type I versus Type II is a question of time
A Type I report describes whether controls are suitably designed at a point in time. A Type II tests whether they operated effectively across a period. Customers who understand the difference usually want Type II, which means you need the controls running before the observation window opens, not after.
You choose the criteria, within limits
The Trust Services Criteria cover security, availability, processing integrity, confidentiality and privacy. Security is the common baseline; the others are included according to what you actually promise customers. Claiming criteria you cannot evidence lengthens the audit and helps no one.
What an assessor will ask to see
- Control descriptions that match what the systems actually do
- Population and sample evidence across the whole observation window
- Access reviews, change records and incident records for the period
- Vendor management records for subservice organisations
- Evidence produced by systems rather than assembled by hand at audit time
Where it usually goes wrong
- Starting the observation window before the controls are genuinely operating
- Evidence that exists for the audit month and not for the rest of the window
- Access reviews performed but never recorded, so they cannot be tested
- Subservice organisations left undocumented until the auditor asks
- Control descriptions written aspirationally rather than descriptively