A customer's security team asked for your SOC 2 report. You don't have one yet, the compliance platform is half set up, and somebody has to pick an auditor.

Probably you.

Pick carefully, because the auditor is the part your customer sees. Their security team reads the auditor's name and the test descriptions in your report. They never see your compliance dashboard.

I run soc2auditors.org , an independent directory of SOC 2 audit firms. Just this year, I’ve read more than 500 requests from companies looking for a SOC 2 auditor and helped them compare quotes.

These are the checks I’d run on any firm before signing its engagement letter, the audit contract.

Two are public lookups that take a few minutes.…