SOC 2 readiness for companies in Georgia

What SOC 2 is

SOC 2 is an attestation report on a service organisation's controls, issued by an independent licensed US CPA firm under AICPA standards. It is not a certificate. The report describes your system and gives the auditor's opinion on whether your controls meet the Trust Services Criteria: security, which is always included, and optionally availability, processing integrity, confidentiality and privacy.

There are two types. A Type 1 report assesses the design of controls at a single date. A Type 2 report also tests whether controls operated effectively over an observation period, usually between three and twelve months. US enterprise customers usually ask for Type 2.

Why Georgian companies need it

Tbilisi and Batumi host a growing number of software product companies, development studios and outsourcing firms. When they sell to US companies, the security review often starts with one question: do you have a SOC 2 report? Without one, the sales cycle slows down with long questionnaires and calls with the client's security team. This affects in particular:

• SaaS startups moving from small customers to mid-market and enterprise accounts in the US.
• Fintech and payment technology companies whose partners need assurance over availability and data handling.
• Development and managed service providers that host or access client systems and data.

Many Georgian companies also sell in Europe, where ISO/IEC 27001 is more common. The two frameworks overlap heavily, and one set of controls can support both.

How BALTUM prepares you

1. Scoping. We define the system in scope, the Trust Services Criteria to include and the report type, based on what your customers ask for.
2. Readiness assessment. We compare your current controls with the criteria and give you a prioritised list of gaps.
3. Control design and policies. Access management, change management, vendor management, incident response, risk assessment, backup and monitoring, written to match how your engineering team works.
4. Evidence preparation. We help you set up the evidence the auditor will request, whether you use a compliance automation platform or manual records.
5. System description. We help draft the description of your system that forms part of the report.
6. CPA firm selection and examination support. We introduce you to a licensed US CPA firm from our partner network and support your team during the examination.

The duration depends on your current maturity, the criteria in scope and the observation period for a Type 2 report. We agree the plan after the readiness assessment.

How the attestation works

The CPA firm performs the examination and signs the report. BALTUM does not issue SOC 2 reports and does not take part in the CPA firm's independent opinion. After a Type 1 report, most companies move to a Type 2 report and renew it every year, so customers always have a recent period covered.

The report contains the auditor's opinion, your management's assertion, the system description and, for Type 2, the tests performed and their results. It is a restricted document: you share it with customers and prospects under a non-disclosure agreement. Any exceptions the auditor finds appear in the report, so it pays to fix gaps before the observation period starts.

Related standards and reading

If your customers are in both the US and Europe, consider combining SOC 2 with ISO/IEC 27001. For a startup-focused guide, read SOC 2 for Georgian SaaS startups selling to the US.

To start, tell us about your product, customers and infrastructure through the request form or at info@baltum.org.

Frequently asked questions

Is there a SOC 2 certificate?

No. SOC 2 is an attestation report issued by a licensed US CPA firm. Anyone offering a SOC 2 certificate is describing something that does not exist.

Can a company registered in Georgia get a SOC 2 report?

Yes. There is no requirement to be a US company. The examination is performed by a licensed US CPA firm, often remotely, on the system that serves your customers.

Should we start with Type 1 or Type 2?

If a customer needs a report soon, a Type 1 gives early assurance while the Type 2 observation period runs. If there is no urgent deadline, some companies go directly to Type 2.

We already have ISO/IEC 27001. How much extra work is SOC 2?

Much of the control set is shared. The additional work is mainly the system description, mapping to the Trust Services Criteria and the evidence the CPA firm samples over the observation period.