Is SOC 2 a certification?

No — SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls against the Trust Services Criteria and issues a detailed report with an opinion; there is no certificate and no accredited certification body involved. That’s why buyers ask to read the report itself. Aegentra’s role is readiness and audit preparation — we design and implement the controls, collect the evidence, and liaise with the CPA firm that issues the report.

SOC 2 or ISO 27001 — which one do we need?

Follow your revenue. US enterprise buyers ask for SOC 2; Australian, UK and European procurement leans ISO 27001. If you sell in both directions, the combined programme is usually the efficient answer — the two frameworks share 60–80% of their controls, so one control set and one evidence engine can feed both the ISO certificate and the SOC 2 report.

Is SOC 2 the same as SOX?

No. SOX is a US federal law about the reliability of financial reporting in listed companies — mandatory, narrow, and tested by your external financial auditor. SOC 2 is a voluntary attestation about the security of a service, driven by customer demand rather than law. Australian subsidiaries of US-listed parents may need both; we deliver SOX ITGC readiness as a separate Govern service.

How long does SOC 2 take?

Readiness typically runs 8–12 weeks depending on your starting point and scope. A Type I report can be issued shortly after readiness completes. A Type II report then requires an observation window — commonly 3 to 12 months — during which your controls must operate and generate evidence. Most clients take a Type I to unblock near-term deals and roll straight into the Type II window.

What does SOC 2 cost in Australia?

Two components: Aegentra’s readiness engagement, which is fixed-fee and quoted after a short scoping call — no hourly surprises — and the CPA firm’s audit fee, which the audit firm sets based on scope, criteria, and observation period. We scope the criteria commercially and negotiate the audit scope with the CPA firm so you are not paying to be examined against criteria your buyers never asked for.

Can we run SOC 2 ourselves in-house?

Yes, with the right skills in the team — and we train them. Our Lead SOC 2 Analyst course — $849 + GST — covers the Trust Services Criteria, scoping, and audit preparation, with the exam voucher included. Many clients combine the two: our team runs the readiness programme while yours upskills, so by the second annual cycle the programme is fully yours.

We already have a CPA or audit firm — can you work with them?

Yes. If your existing firm is licensed to issue SOC 2 reports, we brief them, agree the system description and scope, and manage their request list exactly as we would with a firm we introduced. If they can’t issue SOC 2 attestations, we shortlist firms that can and you choose.

SOC 2 Readiness for Australian SaaS & Service Providers

SOC 2 is the report your US enterprise buyers ask for before they sign. We take Australian SaaS companies and managed-service providers from first gap assessment to a CPA-issued Type I or Type II report — Trust Services Criteria scoped to your platform, controls built in your cloud stack, evidence collected live through Aeges, and the audit brokered with a licensed CPA firm. We prepare; a CPA firm attests.

What SOC 2 is — and what it isn’t

SOC 2 is an attestation report issued under the AICPA’s attestation standards against the Trust Services Criteria — not a certificate. A licensed CPA firm examines the controls behind your service and publishes an opinion your customers’ security and vendor-risk teams read line by line. That is the critical difference from ISO 27001: there is no certificate to frame, there is a detailed report, typically restricted to your customers and prospects under NDA. It is also not SOX — SOX is a US financial-reporting law for listed companies; SOC 2 is a voluntary, market-driven attestation about the security of a service. US and increasingly global enterprise buyers treat a current SOC 2 report as the entry ticket for SaaS and managed services: no report, no deal — or a security questionnaire so long it stalls the sale.

AICPA attestation against the Trust Services Criteria — an examined report, not a certificate.
Issued only by a licensed CPA firm; Aegentra prepares you and brokers the audit.
Restricted-use report your buyers read in vendor risk review; SOC 3 is the public summary.
Market-driven, not legally mandated — the de-facto requirement for selling SaaS into the US.
Not SOX: SOX is financial-reporting law for US-listed groups — a different engagement we also cover under SOX ITGC readiness.

Type I vs Type II — which report you actually need

A Type I report describes your system and tests whether controls are suitably designed at a single point in time. A Type II report covers an observation window — commonly three, six, or twelve months — and tests whether those controls operated effectively across the whole period. Buyers know the difference: a Type I proves you built the machine, a Type II proves the machine runs. The pragmatic path for most Australian providers is a Type I to unblock the deal that is on the table now, rolling straight into the Type II window so the stronger report lands within the year. We design the programme so evidence collected from day one of the observation window counts, and so the same controls serve both reports without rework.

Type I — design of controls at a point in time; fastest path to a first report.
Type II — operating effectiveness over a 3–12 month observation window; what mature buyers ask for.
Common sequence: readiness → Type I → Type II window opens immediately after.
Renewal is annual — Type II reports roll forward with a fresh observation period each year.
Bridge letters cover the gap between report periods for procurement teams.

Scoping the Trust Services Criteria

Every SOC 2 includes the Security criteria — the Common Criteria — as its mandatory backbone. The other four categories are optional and should be scoped commercially, not aspirationally: Availability if you sell an SLA, Confidentiality if you hold sensitive customer data (most SaaS should), Processing Integrity if your platform’s output is the product — billing, payroll, calculations — and Privacy only when you make specific privacy commitments to individuals. Over-scoping inflates both the audit fee and the ways an auditor can find exceptions; under-scoping triggers buyer pushback. We scope the system description around the service your customers actually buy — the platform, its infrastructure, the people and processes behind it, and the subservice organisations underneath (your cloud provider is usually carved out, with complementary controls documented).

Security (Common Criteria) — mandatory in every SOC 2.
Availability — add when you contractually commit to uptime.
Confidentiality — add when you hold sensitive customer data; most SaaS should.
Processing Integrity — add when customers rely on the correctness of your output.
Privacy — rarely needed; only for direct commitments to individuals about personal information.

Readiness: from gap assessment to evidence that holds

Readiness is where SOC 2 engagements are won or lost. We start with a gap assessment of your current state against the scoped criteria, then design and implement the controls in the stack you already run — identity and access in your cloud tenant, change management in your development pipeline, vendor management, incident response, logging and monitoring. Policies are written to match how you actually operate, not templates the auditor will see through. Then evidence: the Aeges risk engine collects control evidence live from your environment across the observation window, so when the CPA firm issues its request list, the population and samples are already sitting there — timestamped, complete, and mapped to the criteria. That is the difference between a two-week fieldwork and a three-month evidence chase.

Gap assessment against your scoped Trust Services Criteria, with a costed remediation plan.
Controls implemented in your real stack — identity, change, vendor, incident, monitoring.
Policies drafted to match your operation, mapped criterion by criterion.
Live evidence collection through Aeges across the whole observation window.
Auditor request (PBC) list largely pre-answered before fieldwork opens.

The CPA-auditor liaison — we sit on your side of the table

Only a licensed CPA firm can issue a SOC 2 report, and the same independence principle we apply to ISO 27001 applies here: the firm that attests cannot be the team that built your controls. That separation is a feature — it means Aegentra sits entirely on your side. We shortlist CPA firms that fit your size and timeline, brief them on the system description, negotiate the scope so you are not paying for criteria you don’t need, manage the request list during fieldwork, and handle exceptions before they become qualified opinions. If you already have an audit firm, we work with them. Your engineers keep shipping; we speak auditor.

Shortlisting and engagement of a licensed CPA firm sized to your business.
System description (Section 3) drafted with you and defended in fieldwork.
Request-list management — evidence delivered from Aeges, not from engineers’ weekends.
Exception handling and remediation before the opinion is drafted.
Works equally with a CPA firm you already engage.

Already on ISO 27001? You’re 60–80% of the way there

The Trust Services Criteria and ISO 27001’s Annex A overlap heavily — access control, change management, operations security, incident management, vendor management, and monitoring appear in both. A mature ISO 27001 ISMS typically covers 60–80% of a Security-scoped SOC 2 out of the box, and the evidence Aeges already collects for your ISMS re-serves the SOC 2 population wherever it is valid. That makes the combined programme the efficient play for Australian providers selling in both directions: ISO 27001 for Australian, UK and European procurement; SOC 2 for the US pipeline — one control set, one evidence engine, two deliverables. We run the mapping, close the genuinely SOC 2-specific gaps, and stage the audits so neither programme delays the other.

60–80% control overlap between ISO 27001 Annex A and a Security-scoped SOC 2.
Aeges evidence re-used across both programmes wherever valid.
Combined programme: one control set feeding both the certificate and the report.
ISO 27001 answers AU/UK/EU procurement; SOC 2 answers US enterprise buyers.
Sequenced so the SOC 2 observation window and ISO audit cycle don’t collide.

SOC 2 readiness in Australia — at a glance

What SOC 2 is	AICPA attestation report against the Trust Services Criteria
Who issues the report	A licensed CPA firm — we prepare you; the CPA firm attests
Type I vs Type II	Control design at a point in time vs operating effectiveness over 3–12 months
Mandatory scope	Security (Common Criteria); Availability, Confidentiality, Processing Integrity, Privacy optional
Who asks for it	US enterprise buyers of SaaS and managed services
ISO 27001 overlap	60–80% shared controls — combined programme available
Typical readiness	8–12 weeks to audit-ready; Type II window 3–12 months
Where controls live	Your cloud stack, evidenced live through Aeges
Fee structure	Fixed fee, quoted after a scoping call; CPA audit fee separate
Delivery	Remote-first, Australia-wide and worldwide

Want your own team to run the programme by the second annual cycle? Aegentra Academy delivers the Lead SOC 2 Analyst course for $849 + GST, exam voucher and one free 12-month resit included. Selling into both markets? Start with ISO 27001 consulting and implementation and run the SOC 2 programme off the same control set.