packets.buildSOC 2 compliance is how many US enterprise buyers shorthand "an independent report on this system." It is an AICPA attestation, not an ISO certificate. A CPA firm issues a Type I or Type II report on a defined system against agreed criteria. Packets does not issue that report. This hub exists because the revised 120-day plan still needs a SOC 2 door for US procurement. ISO 42001 and ISO 27001 are the primary publishing tracks. SOC 2 is secondary, not gone.
If you are an AI-native Indian SaaS selling to US accounts, you will still see SOC 2 in security exhibits. Do not let it crowd out the AIMS and ISMS. Sequence the stack on what comes after SOC 2.
What SOC 2 compliance actually is
A SOC 2 report describes controls over a system. Type I is a point-in-time design opinion. Type II tests operating effectiveness over a period. Criteria come from the AICPA (security, plus optional availability, confidentiality, processing integrity, and privacy). Scope is everything. A report that excludes the AI inference path will not satisfy a buyer who uses that path. Orientation: the AICPA's SOC 2 topic page.
SOC 2 compliance is not "certified." People say certified anyway. In a review, use accurate language: you have a report, for a period, for a system. Link buyers to the report under NDA, not to a blog badge.
Where SOC 2 compliance stops
It does not certify an AI management system. That is ISO 42001. It does not replace ISO 27001. It does not satisfy GDPR, DPDP, HIPAA, or the EU AI Act. Treat SOC 2 compliance as one evidence pack in a multi-framework program. Deep ISO guides: ISO 27001 and ISO 42001 certification.
Observation windows, auditor selection, and report sharing belong in cluster posts. This hub only needs you to know that a tool login is not a Type II.
How Packets treats SOC 2 compliance
We implement controls and evidence with a named specialist and agents on volume. A CPA firm still attests. If you already have a CISO shop and only need software, another vendor may fit. Compare Packets vs Scrut. Product pages: SOC 2 and end-to-end compliance.
We do not claim Packets holds a SOC 2 report in this article. See security.
A practical first pass
- Write the system description the way production actually works, including models and vendors.
- Pick Type I vs Type II based on what buyers already asked for, not what a blog prefers.
- Map overlapping evidence into ISO 27001 so you do not run two wikis.
- Park AI-governance questions on the 42001 track instead of stuffing them into TSC narratives they do not fit.
For a gap view, use the free audit score.
Frequently asked questions
Is SOC 2 compliance required for ISO 42001?
No. Different authorities. US sales may still want both.
Can we skip SOC 2 compliance if we have ISO 27001?
Sometimes, if buyers accept the ISMS certificate. Many US enterprises still ask for the report. Ask the customer, do not guess from this page.
Does Packets sign the SOC 2 opinion?
No. The CPA firm does. We prepare the system to be auditable.
What should we do this week?
If the live deal is US-only and already asking for SOC 2, contact Packets and keep 42001 on the roadmap. If the live deal is AI questionnaires, start with ISO 42001 and implementation.
Related: AI governance hub.
