On this page
Does a small agency need a SOC 2 report?
That depends on the services you provide and on what the buyer actually requires. Ask whether a SOC 2 report is mandatory, which of your services it must cover and which alternatives the reviewer will accept.
When the buyer explicitly requires one, nothing else stands in for it. A security tool or a record of your devices cannot replace an independent SOC 2 examination.
What is SOC 2?
What SOC 2 is.
An outside firm examines how a company that serves clients protects their systems and data, following the standards of the AICPA, the American body for accountants. The result is a signed report.
It is a report about one service over a stated scope, written by the examiner. You cannot get one by installing software, and it covers only what it names.
Why bigger clients ask
Over a third
of companies lost a deal because they lacked a security certification. Ask early what each client needs.
Source: A-LIGN Compliance Benchmark Report
30%
of the data leaks Verizon studied involved a third party, such as a supplier. So larger clients check their suppliers, agencies included.
Source: Verizon DBIR 2025
Ask what the requirement applies to.
A promising project reaches procurement, and someone asks for SOC 2. Before you buy anything, find out what the request is about: your agency, software you run for the client, or the cloud provider that hosts the client’s system. Those are three different things. A report that belongs to one of your suppliers does not cover the work your own team does.
Ask the reviewer to name the service, the scope, the report type and the deadline. Find out whether the requirement is mandatory, or whether there is a documented alternative review for a small supplier. Get that answer early, before your team spends weeks on a proposal built on the hope that procurement will make an exception.
turn a vague request into a decisionthree steps
- 1
Clarify what this buyer requires.
Is the report mandatory, or will the reviewer accept an alternative?
- 2
Scope the service and systems involved.
Which of your services, which report type, which period and which deadline.
- 3
Decide.
Meet the requirement, or agree an alternative the buyer accepts.
Does our cloud provider’s report count?
Your report, or your supplier’s.
A report belongs to the company that was examined. Your cloud provider’s report covers the provider’s service. It does not cover how your own team works, who on your side can reach client data or how you hand over access.
It can still help answer questions about hosting. Ask the reviewer whether it is enough for the part of the work they mean.
Understand what a SOC 2 report actually is.
SOC 2 is an independent examination of the controls at a company that provides a service, carried out under AICPA standards, and the report it produces. A Type 1 report looks at the controls on one date. A Type 2 report also looks at how they worked over a period. Agree the right scope with a qualified practitioner.
It is a report about your service. It is not a badge you install.
For an agency, the service under review can involve people, development processes, cloud systems and client information, as well as laptops. A record of your Macs covers only part of that picture. Never call a device score, a mapping to a framework or a finished questionnaire a SOC 2 certification. Use the real name and scope of the evidence you hold.
| Evidence | What it can answer | What it cannot say |
|---|---|---|
| A SOC 2 reportwritten by an outside examiner | How the controls of the examined service held, on a date or over a period, within the scope the report names. | Anything outside the scope it names. |
| A dated record of your Macskept by a tool such as cybee | Which technical controls held on the assessed Macs, and since when. | How changes are approved, what contractors were trained on or what your policies say. It is not a SOC 2 examination. |
| A finished questionnairewritten by your team | Your answers to one client’s questions, as far as your evidence goes. | Anything the evidence behind each answer does not show. |
Type 1 or Type 2. What is the difference?
Type 1 and Type 2.
A Type 1 report describes your controls as they stood on one date. A Type 2 report also tests whether they kept working over a period, so the records for that period have to exist first.
Ask the reviewer which type they need before you talk to anyone about an examination.
Provider guidance: AICPA: System and Organization Controls services
Prepare a useful answer while the requirement is clarified.
Put together a small evidence pack for the work you are proposing. Include the devices involved, how access is given and taken away, how the relevant accounts are protected, your backups, training and who handles an incident. Mark what you do not know yet and what is missing. Say which people and systems each record covers, instead of claiming the whole agency is secure.
An example: the reviewer asks whether everyone who handles their project uses a protected device. A dated record for the assessed Macs helps answer that device question. It does not show how changes to the live system are approved, or whether every contractor finished their training. Send those questions to the person who owns that part of the work.
evidence pack for one proposal26.09.2026
- Devices on the projectr-0926-0942Ready
- Access given and removedAnaReady
- Account sign in protectionLucaReady
- Backups and a restore testLucaOpen
- TrainingAnaOpen
- Who handles an incidentAnaReady
Two items open, each with an owner. Nothing in this pack is a SOC 2 report.
Make the decision against your real sales pipeline.
If several serious prospects require the report, talk to a qualified provider about the examination, the preparation and what you would have to keep doing afterwards. Ask what your team must do, which records need to build up over time and how the scope changes the engagement. Do not treat a platform subscription as the whole cost, or as a promise that every buyer will accept the result.
If one prospect is asking, and your service touches little of their systems, an alternative review may be worth discussing. The buyer decides whether it is acceptable. Keep the conversation honest. It can end three ways.
-
several require it
Meet it.
Plan the examination with a qualified provider, and start keeping the records it needs.
-
one buyer asks
Agree an alternative.
Your work touches little of their systems. Propose another review, and if the buyer accepts it, get that in writing.
-
mandatory, out of reach
Not this one, yet.
This opportunity may not fit how your agency works today. Say so early.
Make today’s security work useful either way.
Protect your work devices, review who has access, keep software current and write down the decisions your team makes. That helps the business whether an independent examination comes next month or next year. Give each task an owner and keep the records current. A folder built once for a sales call goes stale as people and systems change.
cybee covers the Mac side: protection, the 118 checks, safer settings kept on and dated evidence. Its list of AI tools and their connections helps explain the tools around the work. Connected Google Workspace accounts and training each have their own record. Use every record within the scope it states. The aim is to walk into a bigger client conversation knowing what you can show, what is still open and what the buyer actually requires.
What exactly is a Trust Passport?
The Trust Passport.
The Trust Passport is a dated record of how your Macs are protected. Your client or insurer opens it through one link and sees what holds, since when, and what cybee could not see. It is not a certification or an audit, and it does not answer for your policies, your people or your cloud. It says so on the page.
So it can support the device answers in a review. It does not replace a SOC 2 report.
What to remember.
- Ask whether the buyer requires a report or accepts another review.
- A tool or a record of your devices is not a SOC 2 examination.
- Base your next step on the real scope and deadline of an actual sales opportunity.
Sources and further reading.
- AICPA: System and Organization Controls services
- NCSC (United Kingdom): security guidance for small organisations
Product scope and provider guidance can change. Check the linked source for your own setup. Stuck on a word? Look it up in the security glossary.
Put it to work.
See a client’s security questions answered from dated facts, and the questions your team still owns.
