The U.S.-based SOC 2 standard is starting to catch on in European businesses as well as other parts of the world. Although it’s a voluntary American standard, SOC 2 helps to raise cybersecurity maturity and increase business value.

While researching the latest trends and best practices in cybersecurity compliance, you may have seen increasing reference to the SOC 2 (System and Organization Controls) framework.  

SOC 2 examinations were designed by the American Institute of Certified Public Accountants (AICPA) to help organisations ensure the protection of their data and the privacy of their client’s information. A SOC 2 assessment focuses on an organisation’s security controls that are related to overall services, operations, and cybersecurity compliance. SOC 2 examinations can be completed for many organisations of various sizes and across different sectors. 

Although SOC 2 is typically a customer-driven compliance standard published by an American regulatory body, we are seeing a growing number of European organisations undergoing SOC 2 assessments. To help you determine if SOC 2 is right for your business, let’s examine why SOC 2 has started to catch on in Europe and the benefits it brings to non-American companies.  

Why are SOC 2 assessments becoming more popular in Europe?  

The rising use of SOC 2 in the U.S. over the past decade is largely due to the fact that many large companies wanted to be more proactive about their cybersecurity risk management. These organisations began setting forth requirements stipulating that their vendors must have a SOC 2 report ready as part of the due diligence process.  

Over the past two years, a similar chain of events has started to play out in Europe: Increasingly, companies in certain key industry sectors want to review SOC 2 reports so they can determine that organisations along the supply chain have the necessary controls in place to protect the data of all parties involved. 

There are three primary sectors in Europe (especially within the UK) where there is an increasing demand for SOC 2: banking, insurance, and, most recently, central government. It makes sense that these sectors are some of the first to promote a more wide-ranging approach to cybersecurity compliance since they are among the most regulated fields in the world.  

The rise in popularity of SOC 2 in the U.S., and now, increasingly, in Europe and other parts of the world, has undeniably been driven by the widespread adoption of cloud computing. According to Flexera’s 2021 State of the Cloud Report, 97% of global organisations use at least one public cloud service such as Amazon Web Services.  

Let’s explore two key benefits of leveraging SOC 2. 

Moving from ISO 27001 to SOC 2 

Right now, International Information Security Standard 27001 (ISO 27001) serves as the principal cybersecurity standard for much of the world, and is particularly favoured in Europe. However, we are noticing that an increasing number of European companies are embracing SOC 2 in addition to ISO 27001 to demonstrate a higher level of cybersecurity maturity. SOC 2 is even replacing ISO 27001 outright in some vendor contracts.  

ISO 27001 certification is carried out against a strict controls framework that must be applied to the organisation, regardless of the size or sector, and the audit is pass/fail. With a SOC 2 report, the organisation gets to pick the categories of controls that are tested across five Trust Services Criteria (TSC): Security (required), Availability, Confidentiality, Processing Integrity, and Privacy. Ultimately, the independent assessor’s detailed SOC 2 report contains their expert opinion of how well the organisation meets the selected TSC to protect all aspects of its systems.  

The SOC 2 report is more in-depth than an ISO 27001 pass/fail approach. In fact, the end result of a SOC 2 assessment (an extensive attestation report up to 100+ pages in length) tends to give a company’s partners and clients a higher level of assurance about their security posture compared to the end result of an ISO 27001 audit (a one-page certification letter). This is one of the leading reasons why the cybersecurity compliance norm in Europe is beginning to shift.  

The SOC 2 historical lookback window  

SOC 2 assessments can be carried out in one of two ways: 

• A SOC 2 Type I assessment attests to the design and implementation of controls at a single point in time. The assessor reviews evidence from systems in their current state and produces a Type I report.  This is not dissimilar to an ISO 27001 audit. 
• A SOC 2 Type II assessment attests to the design, implementation, and operating effectiveness of controls over a period of time, usually between 3 and 12 months. In a Type II assessment, the assessor provides assurance that controls are not only designed and implemented, but that they have also operated effectively and as intended over the defined period.  

The SOC 2 Type II report shows whether or not an organisation has historically been adhering to the controls they have in place. While a SOC 2 Type II assessment does take longer to complete, it offers an extra layer of trust to a potential customer or partner. A Type II report essentially says, “we didn’t have to scramble to reach this point. We’ve been taking cybersecurity seriously for some time now.” 

Other benefits of a SOC 2 report  

In addition to helping build trust with prospects, customers, and partners, there are other significant business benefits that a European organisation can unlock with SOC 2 compliance. Let’s take a look at a few of the biggest perks that should be considered.  

A more competitive position 

Possessing a SOC 2 report can give your European business a competitive edge over other organisations operating in your space. Not only can this help you increase revenue by closing more deals, but it can also help retain clients who may have otherwise explored a different company with proof of a more mature cybersecurity posture.  

The ability to expand into the U.S.  

As an American cybersecurity framework, SOC 2 adoption has become widespread in the U.S. over the past 10 years. SOC 2 is, in essence, required to do business with most large or well-known U.S.-based companies, even though it is voluntary and not required by law. In much of the same way that GDPR compliance (which is a law) has become key for American companies looking to sell in Europe, SOC 2 is now a unique selling point for European companies that want to expand into the U.S. 

Future-proofing the business  

The truth is that we are only going to see SOC 2 become more prevalent in Europe over the coming years. In addition to the three sectors mentioned above, the manufacturing and logistics sectors are starting to support SOC 2, especially in the UK. The assessment is also gaining traction in other parts of the world. Australia’s Consumer Data Right (CDR), for example, was introduced to the country’s banking sector in July 2020, and is now being gradually rolled out across other sectors, including the telecommunications and energy sectors. The Australian government has acknowledged that SOC 2 reports can be used as a means to achieve CDR accreditation.  

Does your business need SOC 2?   

So, does your business need SOC 2? The short answer is that, if your clients are starting to ask for it, or if you are planning to expand in the U.S., then you should begin planning for SOC 2 without delay. However, even if that’s not the case for your business, you would be well-advised to initiate conversations with stakeholders in your organisation to discuss how SOC 2 could help facilitate future growth.  

The best way to begin your SOC 2 is to reach out to a reputable, licensed CPA firm in the U.S. This will help you acquire a clearer understanding of where you need to start and what changes need to be made, as well as potential timelines. To make the entire process as efficient and convenient as possible, it’s also wise to choose a firm that has personnel operating in a European time zone, such as in the UK.  

If you’re interested in pursuing SOC 2, now or in the future, A-LIGN is here to help. We were the first-ever licensed CPA firm to focus on IT audits such as SOC 2, and we have clients in over 30 countries and on six continents.