"We're SOC 2 compliant" appears in SaaS company security pages and IT vendor profiles so frequently it has started to lose meaning. Some of those companies have a rigorously attested SOC 2 Type II report covering a full year of operations. Others have a SOC 2 Type I report from a readiness review that required six weeks of documentation work. The certificates look similar. The underlying assurance is very different. This guide explains what a SOC 2 audit actually involves, what the report tells you (and doesn't), and what it costs to get one.
What SOC 2 Is
SOC 2 is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It applies to service organizations — companies that store, process, or transmit data on behalf of their clients. The audit evaluates whether the service organization has controls in place that satisfy one or more of the AICPA's Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is required; the others are optional.
A SOC 2 audit is performed by a licensed CPA firm with attestation competency. The auditor evaluates the design of controls (for a Type I report) or both the design and operating effectiveness over a specified period, typically 6–12 months (for a Type II report). The output is a formal audit report — not a certification, not a checklist — that attests to what the auditor found.
SOC 2 is not a government regulation. There is no enforcement agency. It is a market-driven requirement: enterprise customers and their procurement and legal teams increasingly require vendors that handle sensitive data to produce SOC 2 reports as a condition of doing business.
Type I vs Type II: The Critical Difference
SOC 2 Type I: A point-in-time assessment. The auditor reviews the design of your controls as of a specific date and attests that the controls are "suitably designed" to meet the applicable Trust Services Criteria. A Type I does not tell you whether the controls actually operated correctly over time — only that they were designed correctly.
SOC 2 Type II: An assessment covering an observation period, typically 6–12 months. The auditor evaluates both the design of controls and whether those controls operated effectively throughout the period. This requires evidence from the period — access logs, change management tickets, security awareness training completion records, vendor management documentation, and so on.
Enterprise customers and sophisticated buyers typically require Type II reports. A Type I report has limited value as a trust signal — it means you designed controls at a point in time, not that you've consistently operated them. Many companies pursue a Type I first as a readiness step before their first Type II.
The Trust Services Criteria (What's Actually Being Audited)
The Security criterion — required for all SOC 2 audits — covers whether the system is protected against unauthorized access, both physical and logical. In practice, this means your auditor will evaluate controls in five areas: access controls (who can access what, how access is provisioned and de-provisioned), encryption (data at rest and in transit), monitoring (logging, alerting, incident response), change management (how changes to the system are approved, tested, and documented), and vendor management (how you manage the security of your own third-party service providers).
These are not aspirational standards — they require documented evidence. If you have a formal access provisioning process that lives in someone's head, it does not satisfy the Security criterion. The auditor needs to see a process documented in a policy, evidence that the process was followed during the audit period, and examples of access reviews.
What a SOC 2 Audit Costs
SOC 2 audit pricing varies significantly based on audit scope, company size, and the complexity of the systems being audited. Based on publicly available market data for 2024:
Readiness assessment (pre-audit gap analysis): $5,000–$25,000 from a qualified consulting firm. Not technically the audit — this is the preparation work. A readiness assessment identifies control gaps and produces the documentation needed before the actual audit. Many SaaS startups use readiness automation platforms (Vanta, Drata, SecureFrame) that streamline this work; those tools typically cost $10,000–$30,000/year in licensing and are designed to reduce the manual preparation time.
SOC 2 Type I audit: $10,000–$30,000 from a qualified CPA firm, depending on audit scope and firm size.
SOC 2 Type II audit: $20,000–$60,000 for a first-time audit from a qualified CPA firm. Renewal audits for the same scope are typically 20–30% less. Firms with complex environments, multiple Trust Services Criteria, or multiple system components pay at the high end.
The full-cycle cost — readiness work plus first Type II audit — for a typical 50–200 person SaaS company is commonly $50,000–$100,000 for the first year. Annual renewal audit costs stabilize at $20,000–$40,000 once the program is running.
How Long It Takes
Typical timeline for a first SOC 2 Type II:
Months 1–3: Readiness assessment, policy documentation, control gap remediation. This is often the longest phase for companies without a security program — writing acceptable use policies, incident response plans, vendor management policies, access review procedures, and evidence collection processes takes time.
Months 4–9: Observation period (the audit window). During this period, the company must actually operate the controls it documented. Evidence is collected throughout the period — access reviews performed monthly, change management tickets documented, security training completion records pulled quarterly.
Months 10–12: Auditor fieldwork, report drafting, management response. The auditor reviews the evidence collected, conducts walkthroughs with key personnel, and produces the draft report. The company's management reviews and responds to any findings.
Total: 12–18 months from starting a readiness assessment to having a Type II report in hand.
Frequently Asked Questions
Is SOC 2 required by law?
No. SOC 2 is not a government regulation and has no enforcement authority. It is a market requirement — customers require it contractually. Certain regulated industries (healthcare, finance) have separate regulatory requirements that SOC 2 may partially address but does not substitute for.
What is the difference between SOC 2 and ISO 27001?
Both are information security frameworks, but they differ in scope, enforcement, and geography. ISO 27001 is an international standard (published by ISO/IEC) with a certification model — a certified body certifies that an organization's ISMS meets the standard. SOC 2 is a US-based auditing standard from the AICPA, reporting oriented, and primarily relevant to US enterprise customers. International companies and those with European customers or partners may be asked for ISO 27001 specifically.
Do MSPs need to be SOC 2 compliant?
Increasingly yes, particularly MSPs that serve healthcare, finance, or technology companies. An MSP that manages your IT environment handles sensitive data on your behalf. If you are SOC 2 or HIPAA compliant, your own auditors may require evidence of your MSP's security posture. Ask any prospective MSP whether they have a current SOC 2 report.
What is a qualified SOC 2 auditor?
SOC 2 audits must be performed by licensed CPA firms with attestation competency. The AICPA maintains a directory of licensed firms. Not every accounting firm has SOC 2 expertise — look for firms that specialize in cybersecurity attestation. The major cybersecurity-focused CPA firms have developed significant capacity in this area alongside the traditional Big Four and second-tier accounting firms.