Compliance › SOC 2
SOC 2 complianceSOC 2 compliance: what you need, what it costs and who should deliver it
A customer has asked for a SOC 2 report. This guide explains what auditors actually test, how Type 1 and Type 2 differ, what drives the price and how to choose the right people to help, before you request a single quote.
Free for buyers · provider-funded introductions · Updated October 2026
Where are you in the SOC 2 process?
Pick the question you are stuck on and jump straight to it.
A customer asked for SOC 2
Work out what is actually being requested and what a good-enough answer looks like.
What SOC 2 is → 02 · DecideType 1 or Type 2?
Choose the report your customer will accept, not the one that is easiest to sell.
Compare the reports → 03 · BudgetWhat will it cost?
Understand the drivers before you ask for quotes, so the quotes are comparable.
Cost drivers → 04 · SourceWho should help me?
Auditor, advisor or platform: know which one you need and what to ask.
Who does what →What SOC 2 is, and what it isn't
SOC 2 is an attestation framework from the AICPA, the American Institute of Certified Public Accountants. An independent CPA firm examines how your organisation protects customer data in the systems you operate and issues a report. Your customers' security teams read that report instead of sending you another long security questionnaire.
Two points surprise first-time buyers. First, there is no SOC 2 certificate. People search for “SOC 2 certification”, but what you receive is an auditor's report with an opinion, and that opinion can be qualified if controls fail. Second, no law requires it. It becomes mandatory in practice when enterprise customers, procurement teams or contracts ask for it.
SOC 2 is designed for service organisations: SaaS companies, cloud and data-processing providers, managed service providers, fintech and healthtech platforms, and anyone who hosts, processes or can access customer data.
Signs you need it now
- The questionnaire: a prospect's security review asks for a “SOC 2 Type 2 report”.
- The stalled deal: procurement has paused your contract pending third-party assurance.
- The market: you sell into US enterprises, banks or healthcare, or into their vendors.
- The contract: customer agreements require annual independent attestation.
- The repetition: you answer the same security questionnaire every week.
The five Trust Services Criteria: choose scope deliberately
Security is always included. The other four are optional, and every one you add means more controls to design, more evidence to collect and a larger bill.
| Criterion | What it covers | Include it when… |
|---|---|---|
| Security | Protection against unauthorised access, change and disclosure: access control, change management, risk assessment, monitoring and incident response. | Always. It is mandatory in every SOC 2 report. |
| Availability | Whether systems are available as committed: capacity, backup, recovery and uptime monitoring. | You promise uptime or SLAs, or customers depend on you for continuity. |
| Processing integrity | Whether processing is complete, valid, accurate and timely. | You calculate, transform or move data that customers rely on, such as payments, billing or analytics. |
| Confidentiality | Protection of information designated confidential: classification, encryption, retention and disposal. | You hold customer confidential information under NDA or contract terms, beyond personal data. |
| Privacy | How personal information is collected, used, retained, disclosed and disposed of against your privacy commitments. | You collect and control personal information yourself, rather than only processing it on a customer's behalf. |
A common approach for a first report is to start with Security and add criteria only where a customer requirement justifies them. Start from what your customers' contracts and questionnaires actually ask for, not from what an auditor or tool vendor suggests.
Type 1 vs Type 2: which report do you need?
The difference is time. Type 1 is a snapshot; Type 2 is evidence that your controls keep working.
| Type 1 | Type 2 | |
|---|---|---|
| What the auditor tests | Whether controls are suitably designed as of a single date. | Whether controls were suitably designed and operated effectively over a period. |
| Evidence | Policies, configurations and screenshots at a point in time. | Samples across the whole period: access reviews, tickets, change approvals, logs. |
| Observation period | None. It is a snapshot. | A defined window. First reports often cover a few months; later reports usually cover twelve. |
| How buyers treat it | Useful proof that you have started. | What most enterprise security teams ask for. |
| Typical use | Unblocking an early deal while the Type 2 window runs. | The steady-state annual report. |
Rule of thumb: when a customer says “SOC 2” without more detail, they usually mean Type 2. A Type 1 can bridge the gap, but ask the customer whether they will accept it before you pay for it, because many will not treat it as a substitute.
For a deeper walk-through of the Type 2 report, read our SOC 2 Type 2 explainer.
The path from zero to a SOC 2 report
Six stages. Most of the time and money is decided in the first three.
Scope
Choose the criteria, in-scope systems, locations and audit period, and write the system description the auditor will examine.
Gap assessment
Compare what you do today with the criteria and list what is missing. This is the cheapest place to find surprises.
Remediate
Write and approve policies, then implement the controls you lack: MFA, access reviews, change approval, logging, vendor reviews and incident response.
Collect evidence
Switch on the evidence trail: tickets, approvals, review sign-offs, training records. For Type 2 this starts on day one of the window.
Audit
The auditor tests design (Type 1) or samples across the period (Type 2), then issues the report.
Maintain
Controls must keep running. The audit repeats annually and customers expect a report covering a recent period.
The observation window is the one part you cannot compress. Scoping, the gap assessment and remediation are where time and money are won or lost.
What auditors typically ask to see
Use this as a self-check before you spend on a formal gap assessment.
- Access control: MFA on critical systems, role-based access, periodic access reviews and prompt removal when people leave.
- Change management: peer review and approval before production changes, separation of development and production, documented emergency changes.
- Risk management: a documented risk assessment, repeated at least annually, with owners and treatment decisions.
- Monitoring and logging: central logs, alerts on security events and evidence that someone reviews them.
- Vulnerability management: regular scanning, patching timelines and penetration test results with tracked remediation.
- Incident response: a written plan, defined roles and a record that you have exercised it.
- Vendor management: a list of subprocessors, due diligence on critical vendors and review of their assurance reports.
- People: background checks where lawful, security awareness training, signed policies and onboarding and offboarding checklists.
- Resilience: backups, restoration tests and a continuity and disaster recovery plan, in more depth if Availability is in scope.
- Governance: policies approved by management, reviewed on a schedule, with a named owner for each control.
Missing a few of these is normal; a gap assessment exists to find them. What fails audits is rarely a missing policy. It is a control that exists on paper but does not operate.
What drives SOC 2 cost
Two SOC 2 quotes only compare if the scope is the same. Cost sits in four places: the audit, readiness and remediation help, tooling, and your own team's time. These factors move it most.
| Driver | Why it moves the price | How to keep it in check |
|---|---|---|
| Type 1 or Type 2 | Type 2 tests operation over time, so sampling and fieldwork grow. | Ask the customer which report they will accept. Do not buy both by default. |
| Criteria in scope | Each added criterion adds controls, evidence and testing. | Start from contractual need, not from a template. |
| System boundary | More products, environments, locations and vendors mean more testing. | Scope to the system customers actually use. |
| Starting maturity | Gaps must be fixed before the window opens. | Run a gap assessment before you request audit quotes. |
| Observation period | Longer windows mean more samples to collect and test. | Agree the period with the auditor up front. |
| Auditor and engagement model | Firms differ in size, specialisation, fixed or hourly pricing and what is included, such as retests. | Ask exactly what is in and out of the quote. |
| Tooling | Compliance automation reduces manual evidence work but adds a subscription. | Weigh the tool against your team's hours, not against zero. |
We do not publish a single SOC 2 price because it would mislead. Our SOC 2 cost guide for companies in India shows how these factors play out, and our ISO 27001 cost guide does the same if you are weighing both.
Who does what: auditor, advisor and platform
Three different roles get lumped together. Knowing which one you need keeps quotes honest.
CPA audit firm
Must be a licensed CPA firm and independent of you. Choose on SOC 2 experience in your sector, whether your customers recognise the firm, and how it samples and tests.
Readiness advisor or vCISO
Helps design and implement controls, writes policies and prepares your team for fieldwork. It does not give the opinion on them.
vCISO services in India →Compliance automation platform
Collects evidence from your cloud, identity and ticketing systems. It reduces manual work but does not replace judgement and does not issue a report.
Keep advisory and audit work separate. Independence rules restrict some advisory work by the firm that audits you, so ask any firm offering both how it separates them, and be wary of an auditor who also writes your controls.
Questions to ask any provider
- Experience: which criteria and report types have you delivered, and in my sector?
- Scope: will you accept my proposed scope, or change it, and why?
- The quote: what exactly is included: readiness, fieldwork, retests, report issuance?
- The window: what observation period do you recommend for a first report, and why?
- The effort: who does the fieldwork, and how much of my team's time will you need?
- Failures: what happens if a control fails during testing?
SOC 2 or ISO 27001?
Buyers often ask for one when they mean either. The right choice depends on who is asking.
| SOC 2 | ISO 27001 | |
|---|---|---|
| What you get | An auditor's attestation report. | A certificate from an accredited certification body. |
| Standard | AICPA Trust Services Criteria. | ISO/IEC 27001 management-system standard, with Annex A controls. |
| Strongest recognition | North American customers. | Global, including Europe, India and the Middle East. |
| Focus | Controls over a defined service or system. | An information security management system for a defined scope. |
| Often requested by | US enterprise and SaaS buyers. | Regulated and international buyers. |
Many companies end up needing both. The control sets overlap substantially, so scoping them together can reduce duplicated effort. See our ISO 27001 cost guide for the other side of the comparison.
From your brief to a matched shortlist
Tell us the requirement; we return a short, explained shortlist matched on fit rather than availability.
How it works
- Share a short brief: requirement, sector, geography, size and timeline.
- We return a small, explained shortlist matched on fit rather than availability.
- You compare like for like instead of chasing quotes.
SOC 2 questions buyers ask us
Straight answers on scope, timing and cost.
Is SOC 2 mandatory?
Is there a SOC 2 certificate?
What is the difference between SOC 2 Type 1 and Type 2?
How long does SOC 2 take?
How much does SOC 2 cost?
Which Trust Services Criteria should I include?
How often do I need to repeat the audit?
Can a small startup get SOC 2?
Start with the requirement, not the auditor.
Free for buyers · provider-funded introductions