Securance

Who is Securance?

Securance is a Netherlands-headquartered assurance, advisory, and cybersecurity firm founded in 2004, with a team of roughly 30-60 professionals and offices in Leiderdorp and Utrecht (Netherlands), London, Berlin, and Uppsala.

It serves financial services, technology, professional services, and insurance clients across Europe who need SOC-style attestation, ISAE reporting, or ISO 27001 certification support, often alongside penetration testing and GRC advisory from the same firm.

Securance markets a “Single Audit, Multiple Standards” model: one engagement mapped to cover SOC 1, SOC 2, ISAE 3402, ISO 27001, NIS2, and DORA requirements at once, reducing duplicate evidence requests for clients that need more than one framework. Named clients referenced in its published case studies include ABN AMRO Asset Management, Fujitsu, Axians, a.s.r. (ASR), and Planday.

How does Securance issue a SOC 2 report?

Securance describes itself on its own site as “Europe’s leading issuer” of SOC 2 reports and offers “a SOC 2 report from a European issuer.” A genuine AICPA SOC 2 attestation, by definition, must be issued by a CPA firm licensed and enrolled in the AICPA structure (including the AICPA Peer Review Program).

Securance’s public materials do not name a specific U.S. or AICPA-licensed CPA entity behind its SOC 2 work, do not cite an AICPA Peer Review Program record, and describe the underlying methodology as built on ISAE 3402/ISAE 3000 (the European assurance standards) rather than U.S. attestation standards (SSAE 18/AT-C 105/205).

The practical read: Securance most likely delivers a European ISAE-based assurance report that maps to and is marketed under the SOC 2 label, not a literal AICPA-attested SOC 2 report signed by a licensed U.S. CPA firm. For most European buyers and their European counterparties this distinction may not matter — ISAE 3000 is a recognized, credible international standard. But a buyer selling into the U.S. market whose enterprise customers specifically require an AICPA SOC 2 report should confirm directly with Securance, in writing, exactly which standard the final report is issued under and whether a licensed CPA firm signs it, before assuming it will satisfy a U.S. vendor-security questionnaire.

What credentials does Securance actually hold?

Securance’s credibility case rests on its European assurance standards accreditations (ISAE 3402, ISAE 3000) and ISO 27001 certification work, plus a leadership team with Big Four backgrounds. The firm states its roots trace to one of the Big Four and that many team members previously worked there.

We found no independently verifiable AICPA Peer Review Program record for Securance (or a named affiliated CPA entity) on the AICPA’s public peer review file search — buyers who need that specific proof point should ask Securance directly for it rather than assume it exists. Izak van der Walt is listed on the team as a Chartered Accountant; the firm does not publish individual CPA license numbers or jurisdictions on its site.

What SOC reports does Securance issue?

Securance runs a six-phase SOC 2 process: impact analysis/gap analysis, process and control interviews, a control framework built on COSO 2013, drafting the SOC 2 report, a pre-audit “walkthrough,” and a remediation phase before the final report is issued.

It offers both Type I (point-in-time design opinion) and Type II (minimum six-month operating-effectiveness window) reports — note that six months is Securance’s stated minimum observation period, longer than the roughly 3-month window some U.S.-style engagements use at the low end.

SOC 1 is offered for organizations whose services affect a client’s financial reporting, alongside ISAE 3402 (the ISAE 3402 is functionally the ISAE alternative to SOC 1 that most European service organizations actually need). ISAE 3000 is used for broader non-financial assurance engagements, including sustainability and other subject matter beyond SOC scope.

Does Securance cover ISO 27001, NIS2, and DORA?

Securance is positioned to run ISO 27001 (and ISO 9001) certification-support work alongside its assurance practice, and offers NIS2 and DORA advisory services — gap analysis, incident-management design, and resilience testing — for EU financial institutions and critical-sector organizations navigating those directives.

NIS2 and DORA work here is advisory and readiness-focused, not a certification or attestation in the way SOC 2 or ISO 27001 are; buyers should not expect a signed NIS2/DORA “report” in the same sense as a SOC 2 report.

Does Securance also sell penetration testing?

Securance runs its own cybersecurity practice — network and application penetration testing, cloud security assessments, red teaming, ransomware vulnerability assessment, and phishing testing — as one of the three pillars it bundles under “Advisory, Assurance and Cyber Security under one roof.”

That bundling is exactly the case where independence needs a second look. If Securance’s assurance team is going to issue your SOC 2 or ISAE report, having that same firm’s cybersecurity team run your penetration test creates a self-review consideration: the auditor ends up forming an opinion on controls that its own colleagues tested and potentially remediated. The cleaner posture is to have the pen test performed by a different provider than whoever signs your assurance report — or, at minimum, to confirm with Securance in writing that the assurance and cybersecurity engagement teams (and sign-off) are kept structurally separate on your account before treating the “one-stop-shop” pitch as a single bundled service.

Which frameworks does Securance cover?

Securance does not list HITRUST, FedRAMP, StateRAMP, CMMC, or PCI QSA in its published catalog. It is a European SOC/ISAE/ISO/NIS2/DORA and pentest shop, not a U.S. government-framework specialist.

How much does a Securance SOC 2 audit cost?

We were not able to find published pricing on Securance’s site — like most assurance firms, it quotes after a scoping call. Based on comparable European assurance engagements of this scope and size, our directional estimate is $20,000-$60,000 for a Type I report and $30,000-$80,000 for a Type II report.

This is our estimate, not a number confirmed by Securance, and it will move with headcount, systems in scope, and how many standards are bundled into the single-audit engagement.

How long does a Securance SOC 2 audit take?

Securance’s own SOC 2 phase description (impact analysis through pre-audit and redressing) plus its FAQ noting the readiness scan alone takes “several weeks” suggests a 4-14 week fieldwork-to-report window for a Type I, which is our directional estimate absent a published SLA.

A Type II report additionally requires an observation period — Securance states a six-month minimum, longer than the roughly 3-month window some other markets use at the low end — before the report can be finalized, so buyers on a Type II track should plan total calendar time (observation window plus fieldwork) well beyond the fieldwork estimate alone.

Who is Securance a good fit for?

Best fit for: - European financial services, fintech, insurance, and technology companies that need SOC 1/SOC 2, ISAE 3402/3000, or ISO 27001 handled by one firm under a European (not U.S.-only) assurance framework - Companies that need NIS2 or DORA advisory work alongside their assurance engagement - Buyers comfortable with — or requiring — a European ISAE-based issuer rather than

specifically a U.S. AICPA-licensed CPA firm - Organizations wanting penetration testing, red teaming, and assurance available from a single vendor (with independence properly scoped)

Not a fit — look elsewhere if:

• You specifically need a U.S. AICPA-attested SOC 2 report signed by a licensed CPA firm with a documented AICPA Peer Review record, and your enterprise customer will check for that
• You need HITRUST, FedRAMP, StateRAMP, CMMC, or PCI DSS QSA work
• You want penetration testing and your SOC 2 audit performed by fully separate, unaffiliated firms without having to raise the question yourself

When should a buyer shortlist Securance?

Securance is a Netherlands-founded (2004) assurance, advisory, and cybersecurity firm that bundles SOC 1/SOC 2, ISAE 3402/3000, ISO 27001, and NIS2/DORA advisory under one roof for European buyers, with named case-study clients including ABN AMRO Asset Management, Fujitsu, Axians, ASR, and Planday.

The open question buyers should resolve before engaging is precisely how its “SOC 2” report is issued — as a European ISAE-based report marketed under the SOC 2 label, versus a report from a licensed AICPA CPA firm — since we found no AICPA Peer Review Program record or named CPA entity on its public materials. If your target customer is fine with a European-issued assurance report, Securance’s single-audit, multi-standard model is a genuine efficiency play; if your buyer specifically requires an AICPA-attested SOC 2, confirm that in writing before signing an engagement letter.