A few years ago the question “do you have SOC 2?” was rare for Ukrainian IT companies. Today it sits in almost every security questionnaire sent by a serious US client, and increasingly by European ones. For outsourcing providers, SaaS products and development studios, SOC 2 has moved from “nice to have” to a condition for being shortlisted. Here is what that means in practice for a company operating from Ukraine.
Why SOC 2 and not just ISO 27001
The US market is built around SOC 2, a framework of the American Institute of Certified Public Accountants (AICPA). When an American enterprise gives you access to its data or infrastructure, its vendor risk team wants a report it knows how to read. ISO 27001 is accepted too, but often as a complement rather than a substitute.
For Ukrainian companies selling to both the US and the EU, the most rational path is to combine SOC 2 and ISO 27001 in a single project: roughly 70–80% of policies and controls overlap, and documentation is collected once for both purposes.
Who in Ukraine actually needs SOC 2
- IT outsourcing and outstaffing. Clients in regulated sectors (fintech, healthcare, insurance) are obliged to assess vendors, and SOC 2 is the simplest way to pass that assessment.
- SaaS products. As soon as you sell to mid-market and enterprise buyers, SOC 2 Type 2 becomes a standard procurement requirement.
- Companies processing personal or payment data. Here SOC 2 is usually paired with GDPR compliance — see our article on SOC 2 and GDPR together.
- Startups raising capital. Investors and acquirers treat security process maturity as part of due diligence.
What is specific about SOC 2 for a Ukrainian company
Distributed teams and remote work
The war has pushed many teams to work from different cities and countries. This is not an obstacle for SOC 2, but it requires explicit controls: device management, VPN or zero-trust access, full-disk encryption on laptops, a remote-work policy. The auditor does not require an office — they require evidence that access to client data is controlled regardless of location.
Business continuity
US clients ask specifically about power outages, infrastructure damage and the possible mobilisation of key staff. The Availability criteria and business continuity / disaster recovery controls are where a Ukrainian company can demonstrate maturity: backup connectivity, generators or satellite internet, geographically redundant cloud infrastructure, succession plans for key roles.
Contractors and sole proprietors
Working with developers registered as private entrepreneurs (FOP) is the norm in Ukraine, but to an auditor they are contractors, not employees. You need contracts with confidentiality clauses, signed policy acknowledgements and the same access provisioning and revocation procedures as for staff.
Legal structure
If you have entities in Ukraine, Poland, Estonia or the US, the report scope can cover only the part that delivers the service. This simplifies the audit and reduces the fee.
How the SOC 2 process looks
- Gap analysis and scoping. Which systems, which Trust Services Criteria, which report type.
- Readiness. Policies, controls, training, cloud configuration, evidence collection. Full detail in our SOC 2 readiness checklist.
- Type 1 audit (optional) — confirms control design at a point in time.
- Observation period of 3–12 months during which controls must operate.
- Type 2 audit by an independent CPA firm and issuance of the report.
- Maintenance: annual renewal and a bridge letter between reports.
What US clients ask in security questionnaires
Even before you hold a report, it helps to understand what a vendor risk team is looking for. A typical questionnaire contains 100–300 questions about access control, encryption, incident response, business continuity, personnel screening and subprocessors. Having a SOC 2 report lets you answer most of them with a single reference to the report instead of filling in a new questionnaire for every prospect. For companies with dozens of enterprise customers, the time saved by sales engineers and security staff alone often pays for the project.
Remember, too, that a SOC 2 report contains a section written by your company — the system description. This is where you explain to customers how the product works, where infrastructure is hosted, which subservice organisations are involved and how support is organised. A well-written system description doubles as a marketing document read by technical decision-makers.
Who issues the report and what the consultant does
The division of roles matters. BALTUM prepares the company: analysis, documentation, control implementation, evidence collection and audit support. The SOC 2 report itself is issued by an independent licensed US CPA firm working under AICPA attestation standards. A consultant cannot “issue SOC 2” — if someone promises that, treat it as a warning sign. The audit is performed by the BALTUM group's US-registered CPA firm, whose auditors are experienced with Eastern European companies, which makes communication noticeably smoother.
What SOC 2 costs for a Ukrainian company
| Component | Indicative range | Depends on |
|---|---|---|
| Readiness | scope-dependent | number of gaps, team size, number of systems |
| Type 1 audit (CPA firm) | ≈ $8–20k | scope, number of TSC categories |
| Type 2 audit (CPA firm) | ≈ $15–40k | scope, length of observation period |
| Tooling (if needed) | a few thousand per year | automation platform, scanners, pentest |
Set against the value of a single lost enterprise contract, these numbers are usually modest.
Questions Ukrainian companies ask most often
Do we need a US legal entity?
No. SOC 2 is not tied to the jurisdiction of the service organisation. A Ukrainian, Polish or Estonian company can obtain a report on the same terms as anyone else.
Can we start small?
Yes. The typical path is Type 1 covering Security, then expanding to Type 2 and additional criteria when clients ask for them.
Will SOC 2 satisfy UK clients?
Partly. In the UK, Cyber Essentials is a common requirement; it can be added to the project separately — see Cyber Essentials certification explained.
If your clients are already asking about SOC 2, or you are preparing to enter the US market, request a quote — we will assess your readiness, propose the right scope and introduce you to our US CPA audit team.