Who needs a SOC 2 report?

The need for a SOC 2 report is most often driven by an existing or prospective client request.  If your organisation’s services involve collecting, processing, transmitting, storing, organising, maintaining or disposing of client organisations’ information, you may be asked by those clients to undergo a SOC 2 audit.    

SOC 2 reports are also a common requirement when doing business in the US, with the majority of SOC 2 audits historically having been conducted for organisations operating in the US, or those looking to expand into the US market.  However, it is increasingly common to see organisations outside of the States list a SOC 2 report as a requirement for suppliers and service providers.  

Whilst a SOC 2 report is not compulsory to operate in the US, it will often be necessary if you are looking to build a reasonably sized presence in the US market.  If you are looking to provide services to larger US-based companies and/or federal government-based organisations, you are highly likely to need a SOC 2 report.