SOC 2 compliance: what it is, what it costs, how long it takes

There is no such thing as being SOC 2 certified. SOC 2 produces a report in which a licensed CPA firm gives an opinion on your controls. No software vendor can grant it, including us. What a platform can do is remove the evidence work, which is where nearly all of the cost and the calendar time actually sits.

On this page: what it actually is · Type 1 or Type 2 · the five categories · what gets examined · cost · timeline · what a platform can and cannot do

What SOC 2 compliance actually is

SOC 2 is an attestation engagement performed under the AICPA’s attestation standards. A CPA firm examines the controls at a service organization against the Trust Services Criteria and issues a report containing its opinion. The AICPA’s own SOC materials describe the output as a report throughout.

There is no certificate

This is the single most common misunderstanding, and it shapes everything else. ISO 27001 has a certification body and issues a certificate. SOC 2 does not. There is no accreditation scheme, no registry, and no pass mark. There is a report, and inside it an opinion that is unqualified, qualified, adverse, or a disclaimer.

That matters commercially. When a buyer asks for “your SOC 2 certificate”, what they will accept is the report, usually under NDA. If a vendor sends you a one-page certificate with a logo on it, they have sent you marketing.

Who is allowed to issue the report

Only a CPA firm licensed by a state board of accountancy, subject to NASBA and state licensure rules and to AICPA peer review. This is not a formality. It is the reason the market is structured the way it is: the firm signing the opinion has to be independent of the systems it is auditing, so it cannot also sell you the compliance software or do the remediation work it is opining on.

An attestation engagement requires the practitioner to be independent of the responsible party.

Any vendor telling you they will “get you SOC 2 compliant” end to end, including the audit, is describing an arrangement that independence rules do not permit. The honest version of that sentence is that they do the preparation and an independent CPA does the audit.

Type 1 or Type 2

SOC 2 is one report in the AICPA’s SOC suite of services, alongside SOC 1 for financial reporting controls and SOC 3 for a public summary. Within SOC 2 the two report types answer different questions, and the difference is months of calendar time.

The observation window is your calendar

Nothing about a Type 2 can be compressed below its window. The auditor is testing whether controls operated over a period, so the period has to elapse. A 3-month window is the shortest most firms will sign, and 12 months is the steady state once you are renewing.

This is also the trap in the sales conversation. A deal that needs a Type 2 report in six weeks cannot have one, no matter what you spend. What you can do is issue a Type 1 now and commit contractually to the Type 2 date, which is a normal and accepted move.

The five categories, and why you need one

SOC 2 has five Trust Services Categories, described in the AICPA’s SOC 2 guidance. Scope is a choice, and most companies over-scope it.

Security is the only category you certainly need

The common criteria, numbered CC1 through CC9, cover the control environment, communication, risk assessment, monitoring, control activities, logical access, system operations, change management, and risk mitigation. That is the set every SOC 2 report contains.

Each extra category widens the scope, extends fieldwork, and increases the fee with no commercial return unless a customer actually asked for it. Start with security only. Add categories when a contract makes you.

What the auditor actually examines

Not your intentions. Evidence that a control operated, repeatedly, across the window. Access reviews with dates and reviewers. Change tickets tied to approvals. Vulnerability and patch records. Onboarding and offboarding trails. Incident records. Vendor reviews.

The evidence problem is the real cost

Controls are usually not the hard part. Most engineering teams already do code review, use SSO, and patch. The expensive part is proving each of those ran on a schedule, for months, in a form an auditor accepts.

The auditor tests whether controls operated effectively throughout the specified period, not whether they exist today.

That is why auditor hours balloon on first engagements. When evidence is scattered across Slack threads, spreadsheets, and cloud consoles, the auditor bills for the archaeology.

Penetration testing sits inside this. No Trust Services Criterion requires a pentest, and we say so plainly in does SOC 2 require a penetration test, but auditors expect one and buyers ask for the report itself. The timing rule matters: the test has to land inside the window to count as evidence for it. It is also a separate purchase almost everywhere, by market convention rather than by rule: which platforms include a pentest covers who bundles what.

What SOC 2 compliance costs in 2026

Three separate line items, and vendors routinely blur them.

The audit fee has a hard floor. A CPA firm carries licensure, peer review, and liability, and the opinion takes real hours. Anyone advertising a complete SOC 2 for a few hundred dollars is not paying for a real audit.

Our SOC 2 audit cost breakdown takes each of those three lines apart: what sets the CPA’s floor hour by hour, the five scope levers that legitimately cut the fee, what year two costs, and why the published $30,000 to $50,000 ranges come from people whose subscription looks cheaper beside a large audit number.

Where our own numbers sit

We publish ours, which most of this market does not. Pricing is $299 a month under ten people and $499 at ten or more, or $2,990 and $4,990 paid annually. The CPA attestation starts at $2,500 and is paid directly to the independent firm, never through us, because routing it through us is exactly what would compromise the independence the report depends on. A human-validated penetration test is $2,999 per engagement, a one-time add-on rather than a monthly figure.

For the wider market, our penetration testing cost breakdown shows where day rates come from, and PCI DSS penetration testing requirements covers the framework with the strictest testing language, which is useful contrast if you are scoping for more than SOC 2.

How long it takes

For a first Type 2 with a 3-month window, 4 to 6 months from a standing start is realistic: 2 to 6 weeks to stand up controls and connect evidence sources, 3 months of window, then 3 to 6 weeks of fieldwork and report drafting. A Type 1 collapses that to 4 to 8 weeks because there is no window to wait out.

The variable that moves this most is not audit speed. It is how long you take to close the gaps found in readiness, because the window cannot start until the controls it will observe are actually running.

What a platform can and cannot do

A compliance platform cannot make you compliant and cannot issue an opinion. What it can do is remove the evidence work: connect to your cloud, code hosting, and identity provider, map what it finds to the criteria, and keep collecting for the whole window so the auditor gets an organized package instead of a shoebox.

That is the honest boundary, and it is worth insisting on when you evaluate vendors. The question to ask is not “will you make us compliant”. It is “what percentage of my evidence will you collect without me touching it, and which controls will still be manual”.

Our own answer to why security and compliance belong in one product is on the SOC 2 page, and what lands in your evidence library after each run is on compliance.

How to start

1. Pick the report type your buyer actually needs. Type 1 unblocks a deal now.
2. Scope security only unless a contract names another category.
3. Run a readiness assessment and fix the gaps before opening the window.
4. Choose the CPA firm early. Their calendar, not yours, sets the end date.
5. Open the window and let evidence collect for the full period.

Reviewed against the 2017 Trust Services Criteria with revised 2022 points of focus.