SOC 2 Type II Policies for UK SaaS
13 policies mapped to all 5 Trust Services Criteria — security, availability, confidentiality, processing integrity and privacy. Built for UK SaaS selling to US buyers.
ISO 27001 Core Set pack
16 policies · £400 one-off
Covers SOC 2 common criteria · lifetime access · bespoke
What is SOC 2?
SOC 2 is an auditor-issued attestation developed by the American Institute of Certified Public Accountants (AICPA). It reports on a service organisation's controls relevant to five Trust Services Criteria: Security (always in scope), plus optional Availability, Confidentiality, Processing Integrity and Privacy.
UK SaaS firms typically encounter SOC 2 when selling to US enterprise buyers — it's the North American analogue of ISO 27001. Type I reports on controls at a point in time; Type II tests operating effectiveness over a 3–12 month period and is what US procurement almost always wants to see.
Who needs SOC 2?
- UK SaaS firms selling to US enterprise — requested by almost every US vendor-risk team.
- Fintech and financial-services SaaS — frequently required alongside ISO 27001.
- Managed service providers handling customer data at scale for US clients.
- Scale-ups raising US venture capital — investor due diligence increasingly requests SOC 2 Type II.
- Data-processing and analytics providers where processing integrity criteria matter to the customer.
Policies you need for SOC 2
AICPA doesn't prescribe a fixed policy list, but auditors expect documented policies behind every control. These 13 are the typical scope for a UK SaaS running SOC 2 Type II — all covered by our ISO 27001 Core Set plus NIST CSF Alignment packs:
Security Policy
Common criteria — top-level ISMS policy aligned to TSC CC1–CC9.
Availability Policy
Uptime SLAs, capacity management, DR and backup criteria.
Confidentiality Policy
Confidential-data handling, encryption, secure disposal.
Processing Integrity
Input validation, error handling, output accuracy controls.
Privacy Policy
AICPA privacy criteria plus UK GDPR alignment.
Vendor Management
TSC CC9 — third-party risk, SOC reports from sub-service orgs.
Change Management
TSC CC8 — approved, tested, documented changes.
Access Control
TSC CC6 — logical and physical access, MFA, JML.
Incident Response
TSC CC7 — detection, response, notifications to customers.
Risk Assessment
TSC CC3 — annual risk assessments with treatment plans.
Business Continuity
RTO/RPO, tested DR plan, executive BC policy.
Data Classification
Classification scheme, handling rules, labelling.
Security Awareness
Training cadence, phishing simulations, role-based modules.
Realistic timeline to SOC 2 Type II
From day zero, most UK SaaS firms are 9–12 months to a first SOC 2 Type II report — driven by the required observation period, not the policy work.
- Week 1–2: Scoping — which TSCs, which systems, which CPA audit firm. Buy a PolicySuite pack and get 13 bespoke policies in 48 hours.
- Week 3–6: Implement controls, collect staff acknowledgements, update infrastructure to match.
- Month 2–3: Consider a Type I report as an interim milestone for sales.
- Month 3–9: Operate controls consistently — the observation period. Evidence collection is continuous.
- Month 9–12: Type II audit fieldwork and report issuance.
Policy packs for SOC 2
Further reading
Frequently asked questions
What policies does SOC 2 Type II require?
SOC 2 doesn't prescribe a fixed list but the AICPA Trust Services Criteria expect documented policies covering information security, access control, change management, vendor management, incident response, risk assessment, business continuity, data classification, security awareness, and — if in scope — availability, confidentiality, processing integrity, and privacy. Most UK SaaS firms maintain 12–15 policies for SOC 2 Type II.
Type I vs Type II — which should a UK SaaS start with?
Type I is a point-in-time assessment; Type II tests operating effectiveness over a 3–12 month period. US enterprise buyers almost always ask for Type II. Many UK SaaS firms do Type I first (£10–20k) as a six-month stepping stone, then Type II (£20–40k for a UK SME) once controls have run long enough to test.
Is SOC 2 recognised in the UK?
SOC 2 is an AICPA standard and is usually requested by US buyers. UK buyers typically ask for ISO 27001. UK SaaS firms serving US enterprise markets often need both — our NIST CSF Alignment pack is designed to bridge the two without doubling policy count.
How much does SOC 2 Type II cost for a UK SME?
Budget £20,000–£40,000 for the audit from a CPA firm, plus consultant or tooling costs. Expect 3–6 months of observation period before audit fieldwork. PolicySuite replaces the policy-drafting element (typically £5–10k of consultant time) with a one-off pack purchase.
Do I need SOC 2 if I already have ISO 27001?
Not usually for UK/EU buyers. You'll want SOC 2 Type II when US enterprise procurement asks for it. The two standards share most controls — adding SOC 2 on top of ISO 27001 mainly means producing a SOC 2-format report and running the audit observation period.
What does the SOC 2 policy pack include?
ISO 27001 Core Set (16 policies) plus NIST CSF Alignment Pack (12 policies) cover all 5 Trust Services Criteria and common criteria controls. The InfoSec 38 Enterprise Pack adds deeper SOC 2 Type II coverage. Live pricing on each product page.
Skip the 3-month policy draft
Get 16 bespoke SOC 2-ready policies in 48 hours — lifetime access, no renewal.
Get Started — £400