Planning SOC 2 for a Norwegian business selling to the US
Let actual customer requirements define the SOC 2 scope, report type and timing. Reuse existing security evidence, but assess the gaps before budgeting.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
A US customer asking for SOC 2 gives a Norwegian business a concrete planning question: what report does the customer need, and when?
Start there. Geography alone does not determine the right assurance programme, and a vague intention to sell internationally is not enough to define the scope.
Clarify the buying requirement
Ask which service must be covered, whether the buyer needs Type 1 or Type 2, which trust services categories are expected and how recent the report must be.
A Type 1 report concerns a specified date. A Type 2 report also addresses operating effectiveness over a period. AICPA’s SOC resources describe the examination framework.
Confirm any interim evidence the buyer will consider. Do not assume that a Type 1 report or an ISO 27001 certificate will be accepted in place of the requested Type 2 report.
Assess readiness before starting the period
Define the service boundary, relevant infrastructure, people, procedures and data. Agree the examination scope and period with the CPA firm.
Then check whether controls are operating and records are retained. Access approvals, change reviews and incident follow-up cannot be replaced by writing policies at the end of the period.
The schedule needs preparation time, the reporting period and examination and report-production time. A proposed short engagement should state which of those it includes.
Reuse what is relevant
An existing ISO 27001 system can supply risk processes, policies and evidence. Map those records to the SOC 2 criteria and service commitments rather than assuming a fixed percentage of overlap.
The same record may support both assessments, while differences in scope, period or control design require additional work. Keep one maintained evidence source wherever possible.
Budget for ongoing responsibility
Include the CPA examination, readiness support, internal time, necessary technical changes and any tooling. Ask who maintains evidence and handles exceptions after the initial report.
FM provides readiness support; the independent SOC 2 opinion comes from a qualified licensed CPA firm. The Type 2 explainer describes what the buyer can learn from that report.
Make the investment against named requirements and a realistic plan. The report can support a customer decision; it does not guarantee the contract.
