In an era of stricter laws and regulations, increasing cybersecurity demands, and growing chain responsibility, high-quality and secure Managed Hosting is no longer a side issue, but our priority and specialty. Organizations in digital services need a partner that has structurally guaranteed security, continuity, and compliance, and can demonstrably substantiate this.
After achieving the Type I reports in 2025, we are proud to announce that we have taken the next step: Shock Media has successfully completed the SOC 2 and ISAE 3402 Type II audits, with no findings. This is an important milestone in our ongoing commitment to high-level security, quality, and compliance.
Our SOC 2 Type II and ISAE 3402 Type II reports offer you as a customer significant advantages in terms of compliance. In this article, we will explain the meaning of these standards and the added value they bring to you and your customers.
What are SOC 2 and ISAE 3402?
Within the assurance standards SOC 2 and ISAE 3402, specific requirements and criteria are defined for processes that organizations have outsourced to an external service provider, such as Shock Media.
SOC 2 (System and Organization Controls 2) is a recognized international audit framework that assesses whether your organization takes the right measures to ensure the security of critical processes. As a company, you must meet the criteria outlined in TSP section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. ISAE 3402 (International Standard on Assurance Engagements 3402) is a standard mainly focused on the reliability of outsourced financial processes.
The formal report, drawn up by independent and (RE)-qualified auditors, shows that we meet both standards. The report provides insight into our processes and tells you more about the control measures we have implemented to guarantee the quality and security of our services.
The difference between Type I and Type II reports
SOC 2 and ISAE 3402 Type I reports describe the design and implementation of processes and control measures within Shock Media’s services. The auditor assesses whether these measures are adequately set up to achieve the stated control objectives.
Type II reports go much further. In addition to design and implementation, the operation and effectiveness of these control measures over a defined period—typically six to twelve months—are also assessed. It must be continuously demonstrated that procedures and control measures are actually and consistently applied. Thousands of pieces of evidence must be provided for this!
Shock Media’s first audit period ran until December 31, 2025. During this period, an independent RE auditor performed extensive checks. In early January, this audit was successfully completed, and we now have both a SOC 2 Type II and an ISAE 3402 Type II report. A new audit period has now started, allowing us to provide these assurance reports in the future as well.
What does this mean for our customers?
We deliver what you expect from us. Reliability, quality, and security are the core of our services. This is already demonstrated by our ISO 27001, NEN 7510, and ISO 9001 certifications. These independent audits are conducted annually by certification body Dekra.
With our SOC 2 and ISAE 3402 Type II reports, we offer our customers additional and objective insight into how we handle information security, availability, continuity, and risk management. This provides your organization with an objective foundation to rely on us for the Managed Hosting of your (business-)critical web applications, supported by an independent audit report.
Additionally, these reports support your own compliance obligations. Think of regulations such as the GDPR, but also DORA and the upcoming NIS2 (Cybersecurity Act and related decisions), which impose stricter requirements on cybersecurity, chain responsibility, and demonstrable control measures. By working with a hosting partner that is demonstrably compliant, you reduce risks and simplify your own accountability towards regulators and auditors.
Trustcenter
Would you like to know more about how our processes and measures for our Managed Hosting services are set up, or gain more insight into our SOC 2 Type II and ISAE 3402 Type II reports? Then visit our new Trustcenter in our customer portal at https://my.shockmedia.nl/. Here you will find all information regarding security, privacy, quality management, and compliance, including our certificates and reports.
