System description
Describe service boundaries, commitments, infrastructure and subservice organizations.
Security & cloud
Define the SOC 2 report your customers need
A CPA independently examines service organization controls against AICPA criteria. Select security, availability, processing integrity, confidentiality and privacy scope according to service commitments.
Source record updated:
Discuss your certification →Scope and applicability
Independent CPA attestation report
SOC 2 is not a general Korean statutory certification. International customers may require a particular report type and observation period for vendor due diligence.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- SaaS providers targeting US enterprises
- Vendors asked for SOC 2 during security reviews
- Service organizations demonstrating sustained controls
Documents to prepare
Control matrix
Map Trust Services Criteria to owners, frequency and evidence.
Period-specific operating evidence
Retain access reviews, change approvals, monitoring, incidents and exception handling.
Preparation process
Agree customer requirements
Select Type 1 or Type 2, criteria, period and intended users.
Assess readiness and operate
Close gaps and collect evidence for the agreed period.
Complete CPA examination
Support sampling, inquiries and exception review before report issuance.
Timing
Type 2 requires evidence of controls operating over an agreed period. Separate preparation, observation and examination time; a short turnaround cannot be universally promised.
Agency fees
CPA examination fees
Individual CPA firm quotation
Costs depend on report type, period, criteria and service complexity.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for SOC 2 Attestation based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Do we receive a SOC 2 certificate?
The deliverable is an independent CPA attestation report, distinct from a self-issued certificate or readiness badge.
How do Type 1 and Type 2 differ?
Type 1 addresses control design at a point in time; Type 2 also addresses operating effectiveness over a period.
Does ISO 27001 automatically produce a SOC 2 report?
Existing controls may help, but SOC 2 scope, description, examination and reporting are separate.