Independent attestation reports for service organisations.
Need help? Call usÂ
SOC 2 Type 1
SOC 2 Type 1 evaluates the design of your organisation’s security controls at a specific point in time, confirming they are properly designed to meet the Trust Services Criteria.
SOC 2 Type 2
SOC 2 Type 2 assesses both the design and the operational effectiveness of your security controls over a defined period, demonstrating that they consistently perform as intended.
SOC 2 reports help customers understand how you protect and manage their data.
They are often requested by enterprise clients, especially for SaaS, cloud, and managed service providers.
SOC 2 is most relevant for service organisations that process or host customer data, including:
A SOC 2 examination helps build trust by independently demonstrating that your organisation manages customer data securely and effectively.
GCC delivers SOC 2 examinations through qualified CA/CPA professionals, providing clear guidance & reporting aligned with the AICPA framework.
SOC 2 examinations follow a structured process to define scope, assess controls, perform the examination, and deliver the final attestation report.
Define services, systems, and Trust Service Criteria in scope.
Identify readiness gaps, supporting evidence, and control improvements before examination.
Type 1: Design of controls at a point in time
Type 2: Design & operating effectiveness over a defined period
GCC issues a SOC 2 report that can be shared with customers and stakeholders under appropriate conditions.
SOC 2 cost depends on scope, systems, selected Trust Service Criteria, and whether you need Type 1 or Type 2.
A tailored proposal is prepared once your environment and examination requirements are defined.
Type 1 examinations are usually shorter, while Type 2 examinations cover several months of control operation.
GCC will confirm expected timelines based on your readiness, scope, and control frequency.
SOC 2 can sit alongside:
GCC can support clients considering both ISO 27001 certification and SOC 2 examinations as part of a wider assurance strategy.
Combine ISO 9001, 14001, and 45001 into one streamlined system for efficiency and tender readiness.
Learn MoreInformation Security Management Systems (ISMS)
A Framework for Auditing Service Organisations, Focusing on Non-Financial Reporting Controls
AI Management Systems
Privacy Information Management Systems (PIMS)
A Maturity-Based Cybersecurity Framework to Assess, Strengthen, and Demonstrate Organisational Cyber Resilience
European Data Protection Certification Aligned with the Europrivacy Framework Under Article 42 of the General Data Protection Regulation
Independent Security Assessments for Government and Critical Infrastructure Against the Australian Government Information Security Manual (ISM)
A Combined Approach to Information Security Certification and Service Organisation Controls, Delivering Comprehensive Assurance Across Global and North American Markets
SOC 2 is an attestation, not a certification. A CPA‑led firm issues a report on your controls instead of a traditional certificate.
The criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is mandatory; the others are selected based on your services and risks.
Type 1 reviews the design of controls at a specific point in time. Type 2 reviews the design and operating effectiveness of controls over a period, typically several months.
SOC 2 reports are intended for knowledgeable users such as your organisation, customers, and their auditors. They are often used during vendor risk assessments and due diligence.
Many organisations undergo SOC 2 examinations annually to demonstrate ongoing control effectiveness.
Timelines vary based on scope, readiness, and whether you choose Type 1 or Type 2, but Type 2 often spans 6–12 months of control operation.
ISO 27001 focuses on your management system, while SOC 2 provides a detailed report on specific controls. Many service organisations use both to meet different customer expectations.
Yes, you can select criteria that match your services, but Security is mandatory. Availability, Confidentiality, and others are chosen based on your customers’ needs.
Preparation typically includes defining scope, performing a gap analysis, updating policies and procedures, and confirming control operation and evidence.
Begin by sharing your services, systems, and target Trust Service Criteria. GCC will propose an engagement, timeline, and preparation support that align with your goals.
01
Global Compliance Certification (GCC) is a leading independent certification body for Quality, Safety, Environment, Information Security, Privacy, Food Safety, NDIS and other Management Systems accredited by JASANZ.
Across Australia, Japan, Malaysia, North America and other Countries
