SOC 2 compliance for Indian service providers is an attestation, not a certificate, signed by a licensed CPA firm, with security as the only mandatory category
The FTC Safeguards Rule binds the US firm, not you, but section 314.4(f) forces it into your contract. Here is what an offshore firm must actually prove