SOC 2 is usually triggered by a sales conversation. A prospect asks for the report, the deal stalls, and a company that has never thought about formal compliance has sixty days to work out what it involves.
This is a practical overview for that situation. It is not audit advice, and the specifics of your scope should be agreed with the auditor you engage.
What SOC 2 is
SOC 2 is an attestation report produced by an independent accounting firm, confirming that your controls meet criteria defined by the AICPA. It is not a certification and there is no pass mark — the auditor describes your controls and reports any exceptions found.
Two report types matter.
Type I assesses whether controls are suitably designed at a single point in time. Faster and cheaper, and generally accepted as an interim step.
Type II assesses whether controls operated effectively over a period, usually three to twelve months. This is what most enterprise buyers actually want.
The common path is Type I first to unblock a deal, then a Type II covering the following period.
Choosing the trust services criteria
Five criteria exist. Security is mandatory; the rest are optional and each adds scope, cost and time.
- Security — required in every report. Covers access control, change management, risk assessment, monitoring and incident response.
- Availability — uptime commitments, capacity planning, disaster recovery. Include if you make uptime commitments in contracts.
- Confidentiality — protection of information designated confidential. Commonly included for B2B software.
- Processing integrity — that processing is complete, accurate and timely. Relevant for payments, payroll and similar; rarely needed otherwise.
- Privacy — handling of personal information. Heavy, and often better addressed through other frameworks.
Most first reports scope Security alone, or Security plus Availability and Confidentiality. Ask the customer who requested it which they actually need rather than scoping defensively.
The controls to build first
Roughly in order of how often they appear as exceptions.
- Access control. Unique accounts, SSO, MFA, documented joiner-mover-leaver process, and quarterly access reviews with evidence. Leaver offboarding is the single most common finding.
- Change management. Code changes reviewed by someone other than the author, tracked in version control, with a documented deployment process. Auditors sample pull requests; unreviewed merges to production are an exception.
- Risk assessment. A documented, annual, written risk assessment with identified risks, owners and treatments. Frequently missing entirely in young companies.
- Vendor management. An inventory of subprocessors, their security posture reviewed, contracts in place.
- Monitoring and logging. Centralised logs, alerting on security events, and evidence that alerts are reviewed.
- Incident response. A written plan, named roles, and at least one documented test or real incident handled according to it.
- Business continuity and backups. Documented recovery objectives and evidence of a restore test. See disaster recovery planning.
- Security awareness training. Annual, with completion records for every employee.
- Policies. A documented set — information security, acceptable use, access control, incident response, change management, vendor management — reviewed annually and acknowledged by staff.
Evidence is the real work
Having a control is not enough; you have to prove it operated. For a Type II covering six months, the auditor will sample across the whole period, and gaps cannot be backfilled.
This is the point most first-time auditees miss. A quarterly access review conducted three times and documented once produces an exception. A restore test performed but not recorded did not happen as far as the audit is concerned.
Practical advice: decide at the start where evidence lives, make producing it part of the process rather than a separate task, and keep timestamps. A ticket for each access review, an automated report for each backup test, a signed acknowledgement for each policy.
Compliance automation platforms
Tools in this category connect to your cloud, identity provider and code repository, monitor controls continuously and collect evidence automatically. They typically cost several thousand to low tens of thousands a year.
They are genuinely useful for evidence collection and policy templates, and they do not do the work for you. The controls still have to exist and operate. A company that buys a platform and changes nothing operationally will still fail the audit, just with better dashboards.
Timeline and cost
For a company starting from nothing:
- Readiness work — two to four months to implement controls, write policies and establish evidence collection.
- Type I audit — four to eight weeks from fieldwork to report.
- Type II observation window — three months minimum, six to twelve more typical.
- Type II audit — six to ten weeks after the window closes.
Audit fees for a small SaaS company commonly fall in the $15,000–40,000 range depending on scope and firm, plus the automation platform and a substantial amount of internal time. Budget for a named internal owner; distributing the work across everyone produces a programme that nobody drives.
Mistakes that cost the most
Over-scoping. Adding criteria nobody asked for multiplies the work. Scope to what the customer needs.
Writing policies you do not follow. A policy requiring monthly access reviews that happen quarterly is worse than a policy requiring quarterly reviews. Write what you will actually do.
Starting the observation window before controls are stable. Exceptions early in the window appear in the report. Operate the controls for a month before the window opens.
Treating it as a one-off. Reports are annual. A programme built as a sprint collapses in month four and has to be rebuilt the following year.
Working with the auditor
The relationship with the audit firm shapes the experience more than most first-timers expect.
Choose a firm that works with companies your size. A large firm that mainly audits enterprises will apply enterprise expectations and charge accordingly; a specialist in startups will understand compensating controls for a small team.
Engage them before readiness work is finished, not after. A readiness assessment early will tell you which controls they will actually test and which of your plans are over-engineered. This usually saves more than it costs.
Be straightforward about gaps. An auditor who finds something you concealed will scrutinise everything else. An auditor told about a known gap and your remediation plan will often accept it with a note rather than an exception.
What happens after the first report
The report is the beginning of a cycle, not the end of a project. Three things follow immediately.
Distribution. Reports are confidential and usually shared under NDA. Set up a process — sales should not be emailing the PDF to anyone who asks.
Continuous evidence. The next observation window starts straight away. Controls that lapse in the gap between reports produce exceptions in the next one.
Customer questionnaires. A SOC 2 report reduces security questionnaires but does not eliminate them. Build a standard response document alongside the report; it saves a great deal of sales engineering time over a year.
Frequently asked questions
Is SOC 2 required by law?
No. It is a commercial requirement imposed by customers, not a legal one. Its value is in unblocking enterprise sales.
SOC 2 or ISO 27001?
SOC 2 is dominant with North American buyers; ISO 27001 is more recognised in Europe and Asia. They overlap substantially, and organisations serving both markets often pursue both, which costs considerably less the second time.
Can a company with five employees get SOC 2?
Yes. Controls scale to the organisation — segregation of duties looks different with five people than with five hundred, and auditors accept compensating controls where the team is too small for strict separation.
How long is a report valid?
Type II reports cover a stated period and are generally accepted for twelve months from the period end. Most companies run a continuous annual cycle.
