Hello MSP, SOC 2 Belongs to Your Client!
June 23, 2025
SOC 2 is your client’s responsibility, not yours as the MSP. If you're already ISO 27001 certified, you likely cover much of what SOC 2 needs. Your role is to support their defined controls, not to lead the certification. Let them set the scope, and you align with it. FEHA can help you navigate this the smart way.
A few days ago, an MSP owner asked FEHA, “I built an app for my client. They want to sell it in the U.S. and now they’re asking me to get SOC 2 certified. But we already have ISO 27001. What should we do?”
Here’s what we told him, “Hold on. Your client is the one who needs to drive their own SOC 2. They can’t just hand the responsibility to you, especially when your team is already ISO 27001 certified.”
SOC 2 is about how your client protects their own data and keeps their systems running smoothly. It’s their responsibility to figure out what security, availability, or other controls they need to meet SOC 2 requirements.
They need to define their own rules first based on the kind of service they offer, the data they handle, and what their customers expect. You can’t help them meet SOC 2 if they don’t know what they’re aiming for.
Your Job Starts After They Do Theirs
Once your client has figured out what SOC 2 controls apply to their service, they can tell you what they need from you. That might include showing logs, sharing documentation, or explaining how you protect the app you built.
In audit terms, you’re a "subservice organization." You support their service, but they set the rules.
Your ISO 27001 Certification Is a Big Plus
If you’re already ISO 27001 certified, you’ve likely covered a lot of what SOC 2 asks for. Things like access control, risk management, and incident response are already part of your system. This puts you in a great position to support your client’s SOC 2 efforts without doing anything from scratch.
What Should Happen
Your client defines what SOC 2 means for their business. They tell you which controls apply to the part of the service you provide. You follow those rules and give them the evidence they need. That’s how shared responsibility works.
Key Takeaways
If your client asks you to “get SOC 2,” take a step back. SOC 2 starts with them. They need to define the scope and controls. Once they do, you can help by aligning your existing ISO 27001 practices with their needs.
You don’t need to take on work that isn’t yours. Just focus on doing your part well and helping your clients meet their goals in a smart way.
Need help having this conversation or connecting ISO and SOC 2 the right way? FEHA can guide you.
