What is SOC 2?
A complete guide to SOC 2 for Vietnamese companies looking to sell into the US market
SOC 2 is an independent audit report under AICPA (American Institute of Certified Public Accountants) standards, confirming that a service organization has controls protecting customer data across the 5 Trust Services Criteria. It is issued by a CPA firm in two types: Type I (control design at a point in time) and Type II (controls operating effectively over a period). Vietnamese companies usually need SOC 2 when selling software or services to US enterprise customers.
- Issued under: AICPA standards; reports issued by an independent CPA firm
- Criteria: 5 Trust Services Criteria; Security is required, the other 4 are optional
- Type I: Assesses control design at a point in time
- Type II: Assesses controls operating over an observation period, typically 3 to 12 months
- Legally required? No; customers require it through contracts or security questionnaires
Primary source: AICPA, System and Organization Controls (SOC)
What is SOC 2?
SOC 2 (Service Organization Control 2) is an audit report framework from the AICPA (American Institute of Certified Public Accountants). It is not a law or a certificate: it is an independent CPA firm's report confirming your systems meet defined security criteria.
Vietnamese companies need it because US enterprise buyers ask: their security questionnaire typically includes "Do you have a SOC 2 report?" Without one, the deal can stall there.
SOC 2 is built on 5 Trust Service Criteria (TSC). Security is mandatory; you pick the other four based on service scope:
Protects the system against unauthorized access. Appears in every SOC 2 report.
System is available for operation as committed. Critical for SaaS products with uptime SLAs.
Confidential information is protected as committed. Often added for sensitive client data.
System processing is complete, valid, accurate, and timely. Relevant for fintech and payment processing.
Personal information is collected, used, retained, and disclosed in conformity with commitments.
Most Vietnamese companies start with Security + Availability. That's the minimum scope US enterprise buyers accept.
How do SOC 2 Type I and Type II differ?
This is the first question your auditor will ask. The two types differ not in security level, but in how the audit is conducted.
- Method Auditor confirms controls are suitably designed as of the audit date
- Observation period None
- Timeline 3 to 6 months from start
- Used for Early credential, shows customers you're on the right track
- Method Auditor verifies controls actually operated throughout the observation period
- Observation period Minimum 6 months (typically 12 months)
- Timeline 9 to 18 months from start
- Used for US enterprise sales, vendor agreements, major contracts
Many companies get Type I first to show customers something while the Type II observation period runs.
SOC 1, SOC 2 and SOC 3: what is the difference?
All three are CPA-issued reports under AICPA standards, but they answer different customer questions. Vietnamese SaaS and outsourcing companies are almost always asked for SOC 2.
| Aspect | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| Answers | How do your controls affect the customer's financial reporting? | How do you protect customer systems and data? | Public summary of SOC 2 |
| Criteria | Control objectives defined by the company | 5 Trust Services Criteria | Same as SOC 2 |
| Readers | The customer's financial auditors | Customer security, procurement and vendor-risk teams (under NDA) | Anyone; can be published |
| Usually asked of | Payroll, financial transaction processing | SaaS, cloud, IT/BPO outsourcing, fintech | Companies with SOC 2 that want a public badge |
What are the steps of a SOC 2 project?
Six steps. The first five are the company's work; only the last is performed by the CPA firm. Most of the time goes into steps 3 and 4.
- Define scope and Trust Services Criteria. Which systems, data, locations and services are in scope; pick TSC from what customers actually require.
- Gap assessment. Compare existing controls with the Security criteria (Common Criteria CC1 to CC9) and the selected TSC; the output is an owned remediation list.Evidence checklist
- Build policies and controls. Access control, change management, incident response, vendor management, backup, logging. Policies must describe how the team really operates.
- Operate controls and collect evidence. For Type II, evidence must cover the whole observation period (typically 3 to 12 months).
- Choose a CPA firm. Only a licensed independent CPA firm can issue the report; compare SaaS experience, timeline and quotes on the same scope.
- Audit and report. Provide evidence, answer auditor questions, remediate exceptions; the report is issued after the period ends.
How long does SOC 2 take and what does it cost?
| Phase | Typical duration | Cost involved |
|---|---|---|
| Readiness (steps 1 to 4) | 3 to 6 months when done manually; shorter when controls and evidence are managed on a platform | Internal staff time, consultant or platform, a pentest if customers require it |
| Type I audit | A few weeks after readiness | CPA firm fee, lower than Type II |
| Type II observation period | 3 to 12 months; the AICPA sets no minimum, US customers usually accept 6 months for a first report | Operating the controls; no audit fee during the period |
| Type II audit and report | 4 to 8 weeks after the period ends | CPA firm fee; repeated every year |
How long is a SOC 2 report valid?
A SOC 2 report carries no expiry date. Because it only describes controls during the audit period, US customers usually accept a report whose period ended within the last 12 months. In practice that means a Type II audit every year with consecutive observation periods, plus a management-signed bridge letter covering a gap of up to about 3 months between the end of the old period and the issue of the new report. A bridge letter is the company's assertion, not the auditor's opinion.
Who needs SOC 2 in Vietnam?
Storing or processing US customer data makes SOC 2 almost a prerequisite for their vendor lists.
SOC 2 is the standard answer to how customer data on your infrastructure is protected.
If your team accesses US client systems or data, clients need evidence that access is managed properly.
Financial data carries higher expectations; SOC 2 with the Processing Integrity TSC is frequently required.
Some US VCs and accelerators include SOC 2 in due diligence, especially for B2B SaaS from Series A.
SOC 2 or ISO 27001: which one to choose?
Both frameworks address information security but serve different markets. Knowing the difference helps you choose the right one.
| Aspect | SOC 2 | ISO 27001 |
|---|---|---|
| Primary market | US, Canada | Global, EU, Japan, Singapore |
| Output type | Audit report | Certificate |
| Issuing body | AICPA (US) | ISO/IEC (international) |
| Control overlap | ~60-70% controls overlap, can be done in parallel | |
| Choose when | US/Canada target customers explicitly require a SOC 2 report | Targeting Japan, EU, Singapore or want an internationally recognized certificate |
Frequently asked questions
How long is a SOC 2 report valid?
A SOC 2 report has no official expiry date, but US customers usually accept only a report whose period ended within the last 12 months. Companies therefore run a Type II audit every year and use a bridge letter (signed by management) to cover a gap of up to about 3 months between two reports.
What is the difference between SOC 1, SOC 2 and SOC 3?
SOC 1 reports on controls that affect a customer's financial reporting (for example payroll services). SOC 2 reports on security, availability, processing integrity, confidentiality and privacy controls under the Trust Services Criteria; it is detailed and shared under NDA. SOC 3 is a public summary of SOC 2 without test details. SaaS and outsourcing companies are almost always asked for SOC 2.
Where should a company start with SOC 2?
Start by defining the scope (systems, data, Trust Services Criteria) from what customers ask for in their security questionnaires, then run a gap assessment against the Security criteria. Assign an owner to every control, operate and collect evidence, choose a CPA firm and decide between Type I and going straight to Type II.
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by an independent CPA firm, not a certificate like ISO 27001. The correct term is "SOC 2 report", although many people say "SOC 2 certification".
Who can perform a SOC 2 audit?
Only a licensed, independent CPA firm can issue a SOC 2 report under AICPA standards. Platforms such as pTrackly help prepare controls and evidence, but they do not replace the auditor.
How long does SOC 2 take?
Readiness typically takes 3 to 6 months when done manually. A Type I report can follow right after; Type II adds an observation period, typically 3 to 12 months, before the audit and report.
Is SOC 2 legally required?
No. SOC 2 carries no legal mandate in any country. Companies pursue it because US customers require it. If you don't sell to US enterprise buyers, you may not need it.
What's the difference between SOC 2 Type I and Type II?
Type I checks that controls are suitably designed at a point in time. Type II checks that controls actually operate continuously over an observation period, typically 3 to 12 months; the AICPA sets no fixed minimum. US enterprise buyers typically require Type II before signing major contracts.
Do Vietnamese outsourcing companies need SOC 2?
It depends on the customer. If US enterprise customers require a SOC 2 report in their security questionnaire or vendor agreement, then yes.
Related pages
Scope, cost, markets, and when to choose each.
Start with Type I or Type II? Cost and timeline.
The three cost components, what moves them, and reference ranges from public sources.
Controls, owners, evidence and audit periods on one platform; the CPA firm still issues the report.
SOC 2 and Vietnam's Personal Data Protection Law: where they overlap and where they differ.
Turn compliance knowledge into work that gets done
Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.
In the call, we map your framework, system scope, and how pTrackly fits your current workflow.
Does not replace an independent auditor or certification body.