FAQ: Can we scope SOC 2 to one product rather than the whole company?

Often, yes, provided the scope accurately describes the service and the systems supporting it. Start with the customer-facing product, then trace its data, infrastructure, people, and supporting processes. Shared identity management, HR, support, and deployment systems may still matter even if other products are excluded. Write down the boundary and explain any exclusions to your auditor. Also check whether that boundary answers the customer's actual concern. A narrowly scoped report can be useful, but it should not be marketed as covering unrelated products, business units, or activities that were outside the examination.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview.

Additional FAQs

What is AIUC-1, and how does it relate to SOC 2?

AIUC-1 is an AI-focused standard maintained by the Artificial Intelligence Underwriting Company. Its published scope addresses data and privacy, security, safety, reliability, accountability, and societal risks. It is separate from

What records should we keep from AI model evaluations?

Keep the purpose of the evaluation, the system and version tested, the relevant configuration, the approved test set or its controlled reference, results, and the reviewer’s decision. Explain the intended

How should we control the accounts used by audit automation?

Give each integration only the access needed for its task, and assign a business owner. Prefer identifiable service accounts or supported application identities over a shared employee login. Record the

Can an organization opt for both SOC2 and ISO 27001?

Yes, they can complement each other. SOC 2 may cover specific areas relevant to service organizations, while ISO 27001 provides a broader approach to information security management.

What are the costs of SOC 2?

SOC 2 cost depends on the system scope, report type, reporting period, and work needed before the examination. Budget separately for the CPA firm’s fee, any readiness advice, optional software,

Are Representation Letters Required in SSAE 18?

Yes. For SOC 1 examinations, the applicable AT-C requirements call for management’s written representations. This was not entirely new with SSAE 18: SSAE 16, codified in former AT section 801,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide