SOC 2 for Vietnamese IT outsourcing companies
When US customers actually require it, what the scope covers for outsourcing, and a realistic roadmap to get started.
When a US customer actually asks for SOC 2
US startups and SMBs rarely ask. With enterprise and fintech, four situations come up:
An 80-150 question form that opens with "Do you have a SOC 2 Type II report?" A no triggers escalation and requests for compensating controls.
The MSA requires maintained SOC 2 Type II compliance and an annual report. Signing it commits you to the report.
Terms are agreed, then the customer's CISO asks for evidence. Without a report, you send policies one by one for weeks.
The RFP makes a SOC 2 Type II report mandatory. Without it, you are cut at qualification.
None of these yet? SOC 2 can wait. Once US enterprise deals enter your pipeline, run a gap assessment.
What SOC 2 covers for an outsourcing company
Scope typically covers the development environment: access to source code and production, employee account management, client data handling in dev and test, incident response, and logging and monitoring. There are no headcount or revenue thresholds: you and the auditor agree the scope.
SOC 2 versus ISO 27001 for outsourcing
| Aspect | SOC 2 | ISO 27001 |
|---|---|---|
| Who requires it | US enterprise and fintech | Japan, EU, Singapore, global enterprise |
| Output type | Audit report (not a certificate) | International certificate |
| Control overlap | 60-70% of controls overlap | |
| Time to first credential | Type I: 3-6 months | Certificate: 6-18 months |
| Annual audit cost | Ask 2-3 CPA firms to compare | Varies by CB and company size |
Roadmap: getting SOC 2 as an outsourcing company
Define scope and Trust Service Criteria (Security required; Availability and Confidentiality per customer needs). Document gaps.
Access management (MFA, least privilege, access reviews), logging and monitoring, tested incident response runbooks, HR security (onboarding, background checks, offboarding).
A CPA firm checks control design at a point in time. Some customers accept Type I while Type II is pending.
Controls must operate consistently throughout the observation period, typically 3 to 12 months. During this period, collect evidence continuously: access logs, change management records, incident reports, vendor review records. This is the most execution-intensive phase.
The CPA firm tests operating effectiveness across the observation period, producing the Type II report US enterprises require.
Cost reality: what to know before budgeting
Readiness and audit fees vary too widely by scope and CPA firm for a reliable figure. Send the same scope (systems, headcount in scope, TSC) to 2-3 AICPA-licensed CPA firms and compare quotes.
Frequently asked questions
Do US customers actually require SOC 2?
Not all of them, but US enterprise and fintech buyers frequently require it. The clearest signal is a vendor security questionnaire or Master Service Agreement with a SOC 2 clause. Startups and SMBs rarely require it.
Does a 50-person outsourcing company need SOC 2?
It depends on the customer, not the company size. If a large US customer requires a SOC 2 report, a 50-person shop still needs it to keep the contract. If all customers are startups or SMBs, you likely do not need it.
SOC 2 or ISO 27001 for outsourcing?
ISO 27001 is the better fit if you have customers in Japan, EU, or Singapore. SOC 2 is better if customers are primarily in the US. Many large Vietnamese outsourcing companies do both because they serve both markets.
Turn compliance knowledge into work that gets done
Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.
In the call, we map your framework, system scope, and how pTrackly fits your current workflow.
Does not replace an independent auditor or certification body.