What It Is

SOC 2 (System and Organization Controls 2) is a voluntary attestation framework developed by the AICPA to evaluate service organizations' controls over customer data. It focuses on Trust Services Criteria (TSC)—principles-based assessment of systems handling sensitive information via risk-based controls.

Key Components

• Five TSCSecurity** (mandatory, CC1-CC9), Availability, Processing Integrity, Confidentiality, Privacy (optional).
• 50-100 controls mapped to Common Criteria (CC series), built on COSO principles.
• Type 1 (design at point-in-time); Type 2 (design + operating effectiveness over 3-12 months).
• Independent CPA audit model with unqualified opinions ideal.

Why Organizations Use It

Drives enterprise sales by streamlining due diligence, reducing CAC 20-50%. Mitigates breach risks ($1M+ liabilities), builds trust moats for SaaS/cloud providers. Voluntary but market-mandated for VRM; overlaps frameworks like ISO 27001 (80%), HIPAA.

Implementation Overview

Phased: gap analysis (2-4 weeks), control deployment (4-8 weeks), monitoring (3-6 months), audit (1-2 months). Targets SaaS/fintech (10-500+ employees); automation (Vanta) cuts effort 70%. Annual recertification with bridge letters.

What It Is

BREEAM (Building Research Establishment Environmental Assessment Method) is a science-led sustainability certification framework for the built environment. It assesses performance across buildings, infrastructure, and communities throughout their lifecycle, using a credit-based, weighted scoring methodology to deliver comparable ratings.

Key Components

• **Ten core categoriesManagement, Health & Wellbeing, Energy, Transport, Water, Materials, Waste, Land Use & Ecology, Pollution, Innovation.
• Hundreds of credits across issues, with scheme-specific manuals and Knowledge Base Compliance Notes (KBCNs).
• **Rating levelsPass (≥30%), Good (≥45%), Very Good (≥55%), Excellent (≥70%), Outstanding (≥85%).
• Third-party certification via licensed assessors and BRE audits.

Why Organizations Use It

• Drives ESG compliance, net-zero alignment, and operational savings (e.g., 22-33% energy reduction).
• Enhances asset value (up to 30% premiums), tenant appeal, and regulatory readiness (e.g., EU Taxonomy).
• Mitigates risks in climate resilience, biodiversity, and greenwashing via auditable evidence.

Implementation Overview

• Phased approach: pre-assessment, design integration, construction evidence, certification, In-Use monitoring.
• Applies globally to all sizes/types; requires early assessor/AP involvement, evidence management, BRE training.