Before a procurement contract gets signed, the buyer’s security review team will ask for your SOC 2 report. The answer you give could shape whether the deal moves or stalls.
For a growing number of CISOs, SOC 2 has become less a compliance exercise and more a revenue dependency, one you own. This guide covers what SOC 2 attests to, how to scope a program that satisfies your buyers without over-committing, what it costs and how long it takes, and how to run it as a continuous program rather than an annual scramble.
What is SOC 2?
SOC 2 is a reporting framework created by the American Institute of Certified Public Accountants (AICPA). It evaluates how well your organization protects customer data across a defined set of controls.
One common misunderstanding with SOC 2 is that it’s a certification. Instead, SOC 2 is an attestation. That means that a certified official has examined your processes, tested your controls, then issued a formal report of what they found. A better way of thinking about SOC 2 is that a witness has confirmed your processes are legitimate. This verdict must be delivered by a licensed CPA (Certified Public Accountants) firm.
In practice, SOC 2 will result in a 50-to-100-page report that your customers can read in order to decide whether they trust you and your processes.
This means something different for vendors and customers. For customers, if a company shares a SOC 2 report with you that was not issued by a licensed CPA professional, then the report is not valid. Any form of self-assessment will be rejected outright. If the report is not carried out by a reputable member of AICPA, the report does not have value.
The Five Trust Services Criteria
A SOC 2 report is structured around five criteria, with only one of them being mandatory: Security. This focuses on providing protection against unauthorized access.
The other four criteria are not essential and will depend on what a company is set up to do. These criteria include:
- Availability: This addresses system uptime and resilience, most relevant if your organization makes commitments related to uptime.
- Processing Integrity: This covers the way that your system processes data, ensuring that it is handled accurately and safely.
- Confidentiality: Covering how information is designated and handled within the organization.
- Privacy: Covers how personal information is collected, used, and disposed of.
It is not uncommon for organizations to evolve their SOC 2 reports over time, with the initial report focusing on security alone. That is because it satisfies the essential criteria, which the majority of buyer requests will focus on. From there, organizations can increase their coverage as their investment rises. This trend is an evolving one, with more buyers looking for Availability and Confidentiality covered too.
If you’re a provider, it might be worth looking at your customer base to understand what criteria are most important for your sector.
Type I versus Type II
There are two types of SOC 2 reports, with each one having a different impact on your timeline and budget.
- Type I Report – This type of report assesses whether your controls are correct at a single point in time. They take a snapshot of your policies and assess their efficacy. This type of report can be produced quickly as it does not require an observation period. Consequently, it is more limited in scope.
- Type II Report – This report will assess how your controls work over a period of time. This observation period will result in a more comprehensive report that carries more weight. It proves that your controls work consistently, rather than on one occasion. Ultimately, all organizations will aspire to having a Type II report.
Type I reports may be used to secure deals initially, with the Type II report beginning its observation period. This would result in you paying for two separate reports (so you could go straight for a Type II report), but then you’ll have something to prove your security sooner.
The SOC 2 Roadmap
Thanks to the widespread understanding and recognition of SOC 2 reports, there is a clear path that you can follow to get one. It’s worth noting that the auditing itself is rarely the bottleneck. Instead, it is the preparation phase that sometimes poses difficulties for organizations. For the most part, organizations underestimate how much time and detail the preparation phase requires.
- Run a readiness assessment – Compare your current controls against the criteria that you’ve selected. This allows you to address gaps before an auditor finds them.
- Close the gaps – Remediation can be the most significant step in terms of time and resource. You may have to address controls across change management, multi-factor authentication, encryption, access management, logging, monitoring, and incident response. Depending on the maturity of your infrastructure, this can be a substantial work list.
- Set your specifications – Decide which criteria your SOC 2 report will cover. Audit firms will tend to recommend deciding on your scope before you request quotes as pricing will be dependent on this. Any adjustments to headcount, scope, and system inventory will result in a recalculated quote.
- Run the observation period – This step is only relevant for Type II reports. It is also the stage that has the biggest impact on the calendar. Auditors will typically expect an observation window of at least three months, with six months being common. For organizations looking to renew their SOC report, twelve months is often cited as the correct length. It is important that you only start this step when you are confident that you have the necessary controls in place, and that they are operating consistently. Any control failure would result in a weak report, meaning you may choose to restart the control window.
- Collect evidence – During the observation, you will gather proof that your controls are effective. This will include access reviews, system logs, training records, incident documentation, and configuration exports. Automation can reduce the burden of completing this step.
- Produce the report – This step is not for you to complete but will be the responsibility of the auditor. A licensed CPA firm will conduct the fieldwork, test the evidence, and then issue the report.
The Costs and The Timescale
When completing your first SOC 2 Type II report, the timeline is usually just under twelve months. This is broken down into three months of preparation (readiness and remediation), six months of observation, then a number of weeks to complete the report. Teams with mature security status may reduce the initial prep time.
In terms of cost, budgets range drastically depending on scope and organizational differences. You can expect a Type I audit to cost somewhere in the region of $7,500 – $20,000, with Type II sitting somewhere between $15,000 and $70,000.
These figures also depend on which firm you engage to carry out the reporting. If you work with a larger, more prestigious firm, your budget may exceed $150,000 for complex programs.
It is also worth factoring in a compliance automation platform throughout the testing. This will ensure that you can address issues quickly, and your report is as good as it can be. You should expect to set your budget for this somewhere between $5,000 and $15,000 for smaller teams.
SOC 2 versus ISO 27001
For organizations operating internationally, you will also be expected to prove compliance with ISO 27001. This is the global standard for information security management. There is a good deal of overlap between the two frameworks, meaning that your workload is not doubled when seeking compliance from both.
The main difference is down to geography. SOC 2 is most prevalent in North America and results in an attestation report. ISO 27001, on the other hand, is a globally recognized certification. You should look at your customer base when deciding which framework to pursue first. If both are relevant to your organization, pursuing both in tandem is often more efficient than addressing them in sequence.
What’s New For 2026?
While the main structures of SOC 2 have not changed since 2017, AICPA published guidance in 2022 and 2023, adding context for modern technologies. This does not change the underlying criteria but it does alter how teams reach compliance and what buyers expect.
Compliance is continuous
There was a time when SOC 2 monitoring was treated as an annual event, rather than being continuous and ongoing. Today, automation platforms will continuously pull evidence from cloud infrastructure, your identity provider, and code repositories. This ensures that reports are accurate, whilst reducing the burden of having to spin up monitoring for a few months each year.
AI is everywhere –
The audit process itself will utilize AI to map controls, flag gaps, and draft evidence. Simultaneously, your use of AI must also be monitored and controlled. If your product uses AI or handles data through AI tools, auditors and buyers will expect to see good governance and data handling.
Buyer expectations –
Beyond requesting additional criteria, security review teams are scrutinizing reports more closely than ever before. A report that is too thin or limited in its scope can halt a deal due to lack of clarity.
The Bottom Line
A SOC 2 report does not last forever. It covers a defined window of time and is usually treated as valid for twelve months after this. You’re only as good as your most recent report.
The organizations who treat compliance as continuous will be best positioned to navigate this. They may choose to run monthly access reviews, quarterly risk assessments, and annual policy updates. They will let their automation platform collect evidence year round, making the SOC 2 process a confirmation rather than a test.
The most common mistakes arise when organizations over-scope by including criteria that customers never asked for, or when they start the observation period before controls are ready.
SOC 2 is no longer a nice-to-have for software companies selling upmarket. It is the document that decides whether you are a viable option or not. Scope it to what your buyers actually need, lean on automation to carry the evidence burden, and start early enough that the timeline works in your favor rather than against a deal already on the table.
