A SOC 2 report is an independent auditor’s assessment of how well a service organisation protects customer data. It’s issued by a licensed CPA firm under attestation standards set by the American Institute of Certified Public Accountants (AICPA), and it evaluates your controls against a defined set of criteria called the Trust Services Criteria.
If your company stores, processes, or transmits customer data – think SaaS platforms, cloud hosting providers, payroll processors, or IT service providers – a SOC 2 report is often the single most-requested document in enterprise vendor security reviews. It’s become the de facto proof point that a business takes data security seriously, especially in the US market.
Unlike a certification (which you either pass or fail), a SOC 2 report is an attestation: the auditor examines your actual controls and issues a report describing what they found. There’s no universal pass/fail – the report documents your control environment, and the reader (usually a prospective customer’s procurement or security team) decides whether it meets their bar.
Key Takeaways
| Question | Short Answer |
| What does SOC 2 assess? | Controls related to security, availability, processing integrity, confidentiality, and privacy of customer data |
| Who issues it? | A licensed CPA firm, under AICPA attestation standards |
| Is it mandatory? | No – it’s not a legal requirement, but many enterprise contracts require it |
| Type I or Type II? | Type I = point-in-time snapshot; Type II = tested over 3–12 months |
| How long does it take? | Type I: roughly 2–6 months. Type II: roughly 6–15 months, including the observation period |
| What does it cost? | Type I audits commonly range from around $10,000–$40,000; Type II from around $20,000–$100,000+, depending on scope and organisation size |
| Does it expire? | No formal expiry, but Type II reports are typically renewed annually to stay useful to customers |
SOC 2 vs SOC 1 vs SOC 3: How They Differ
If you’ve already read our guide on SOC 1 reports, you know SOC reports aren’t one-size-fits-all. Here’s how the three main types compare:
| Report | Focus | Typical Audience | Confidential? |
| SOC 1 | Controls relevant to a client’s financial reporting | Auditors, finance teams | Yes – restricted distribution |
| SOC 2 | Controls relevant to security, availability, processing integrity, confidentiality, and privacy | Customers’ security/procurement teams | Yes – restricted distribution |
| SOC 3 | Same criteria as SOC 2, but a general-use summary report | Marketing, public website, general audiences | No – freely shareable |
In short: if a customer’s finance team wants assurance about how your systems affect their financial statements, that’s SOC 1 territory. If their IT security or vendor risk team wants assurance about how you protect their data, that’s SOC 2. If you want a shareable, public-facing summary you can post on your website, that’s SOC 3.
The Five Trust Services Criteria
Every SOC 2 audit is measured against the AICPA’s Trust Services Criteria (TSC), first issued in 2017 and most recently updated with revised points of focus in 2022. There are five categories, but only one is mandatory:
- Security (mandatory for every SOC 2 report). Covers protection against unauthorised access – logical and physical access controls, system monitoring, incident response, and change management. This is organised into nine “Common Criteria” groups (CC1–CC9) that every SOC 2 audit tests.
- Availability (optional). Whether your systems are available for operation and use as committed – relevant if you offer uptime guarantees or SLAs.
- Processing Integrity (optional). Whether system processing is complete, accurate, timely, and authorised – relevant for platforms handling transactions or calculations.
- Confidentiality (optional). Whether information designated as confidential is protected as agreed.
- Privacy (optional). How personal information is collected, used, retained, disclosed, and disposed of.
You don’t need all five. Most companies scope their SOC 2 audit around Security plus whichever additional criteria match the commitments in their customer contracts and SLAs – for example, a payments platform is likely to add Processing Integrity, while a healthcare-adjacent SaaS tool might add Privacy.
Good to know: Security is the only criterion required on every SOC 2 report. Adding more criteria means more testing – and more cost – so it’s worth scoping carefully with your auditor rather than defaulting to “all five.”
SOC 2 Type I vs Type II
This is the question we hear most often, so here’s a direct comparison:
| Type I | Type II | |
| What it tests | Whether controls are designed properly, at a single point in time | Whether controls are designed properly and operated effectively over a period |
| Observation window | None – a snapshot | Typically 3–12 months (6 months is a common industry standard) |
| Typical timeline | ~2–6 months start to finish | ~6–15 months, including the observation period |
| Typical cost | ~$10,000–$40,000 | ~$20,000–$100,000+ |
| Market acceptance | Useful as an interim step; many enterprise buyers won’t treat it as sufficient on its own | The industry-standard expectation for mature vendors and most enterprise procurement teams |
| Best for | Early-stage companies needing a fast, credible first report | Companies with established controls, or facing enterprise deals that specifically require it |
Example: A 40-person SaaS startup fielding its first enterprise RFP might start with a Type I report to unblock the deal quickly, then begin the Type II observation period immediately afterwards so they have a Type II report ready within 6–12 months – a common “Type I now, Type II next” strategy.
Who Actually Needs a SOC 2 Report?
SOC 2 isn’t legally mandated for any industry, but it’s become a practical requirement in several situations:
- You sell to enterprise or mid-market customers. Their procurement or security teams almost always ask for it before signing.
- You handle sensitive customer data – PII, financial data, health information, or proprietary business data – as part of a SaaS, cloud, or managed IT service.
- You’re a subcontractor or vendor to a regulated company – banks, insurers, and healthcare organisations routinely push SOC 2 requirements down their vendor chain.
- You compete in a market where SOC 2 has become table stakes – in US SaaS and cloud services particularly, lacking a SOC 2 report can eliminate you from consideration before conversations even start.
If none of the above applies – say, you run a small local service business with no data-handling exposure – a SOC 2 report is unlikely to be worth the investment. It’s a commercial and security-assurance tool, not a general compliance obligation.
The SOC 2 Audit Process, Step by Step
- Define scope. Decide which Trust Services Criteria apply (Security is mandatory; add others based on your customer commitments) and which systems/teams are in scope.
- Readiness assessment. Many organisations run an internal or third-party readiness assessment first, to identify control gaps before the formal audit begins.
- Remediate gaps. Implement or tighten controls – access management, logging, incident response plans, vendor risk processes, and so on.
- Select your auditor. SOC 2 reports must be issued by a licensed CPA firm with SOC audit experience. See our guide to top audit firms in the US if you’re starting that search.
- Type I audit (optional first step) or begin observation period. If going straight to Type II, your controls now need to operate consistently for the full observation window (commonly 3–12 months).
- Fieldwork. The auditor tests your controls – for Type II, this includes sampling evidence (logs, access reviews, change records) across the observation period.
- Report issuance. You receive the final SOC 2 report, which you can share under NDA with prospective and existing customers.
- Renew annually. Most companies repeat the Type II cycle every 12 months to keep the report current for ongoing sales cycles.
How Much Does a SOC 2 Report Cost?
Costs vary significantly based on company size, systems complexity, number of Trust Services Criteria in scope, and which CPA firm you use. As a rough guide, based on current industry benchmarks:
| Report Type | Typical Audit Fee Range | Typical Timeline |
| Type I | $10,000–$40,000 | 2–6 months |
| Type II | $20,000–$100,000+ | 6–15 months |
Keep in mind these figures usually cover the audit itself – many companies also budget separately for readiness assessments, remediation work, and compliance automation tooling, which can add meaningfully to the total first-year cost.
Common Challenges (and How to Avoid Them)
- Underestimating the observation period. Type II’s 3–12 month window is often the biggest planning miss – controls need to be operating, not just documented, from day one of the window.
- Scope creep. Adding Trust Services Criteria you don’t actually need (because “more sounds better”) inflates cost and audit time without adding sales value. Scope to your actual customer contracts.
- Treating it as a one-time project. SOC 2 compliance is an ongoing operating discipline, not a project with a finish line – controls need continuous monitoring and evidence collection.
- Choosing an inexperienced auditor. Not every CPA firm has deep SOC audit experience. Ask for references and sample reports from similar-sized clients before engaging.
- Weak internal audit function. Companies with a mature internal audit function tend to move through SOC 2 readiness faster, since much of the control documentation and testing discipline already exists.
SOC 2 vs Other Frameworks (ISO 27001, HIPAA)
SOC 2 isn’t the only security framework on the market, and it’s worth knowing how it sits alongside the others:
- ISO 27001 is an internationally recognised certification (pass/fail against a formal standard), while SOC 2 is an attestation report describing your controls – no formal pass/fail. Some companies pursue both, since many controls overlap.
- HIPAA is a US legal requirement for healthcare organisations and their business associates; SOC 2 is voluntary but often layered on top of HIPAA compliance for healthcare-adjacent SaaS vendors seeking broader market credibility.
- SOC 2 vs SOC for Cybersecurity: SOC for Cybersecurity is a broader, entity-wide report on cybersecurity risk management, while SOC 2 is scoped specifically to a service organisation’s systems relevant to the Trust Services Criteria.
FAQs
Is SOC 2 legally required?
No. SOC 2 is a voluntary attestation, but it’s frequently a contractual requirement from enterprise customers, especially in SaaS, cloud, and IT services.
How long is a SOC 2 report valid?
There’s no formal expiry date, but Type II reports typically cover a specific 3–12 month period, and most customers expect a renewed report roughly every 12 months.
Can a small business get SOC 2 certified?
SOC 2 isn’t a “certification” – it’s a report – but yes, businesses of any size can undergo a SOC 2 audit. Cost and scope simply scale with your systems’ complexity.
What’s the difference between SOC 2 and ISO 27001?
ISO 27001 is a certifiable international standard; SOC 2 is a US-originated attestation report. Both address information security, and many organisations pursue both because the underlying controls overlap significantly.
Do I need all five Trust Services Criteria?
No. Security is the only mandatory criterion. The other four (Availability, Processing Integrity, Confidentiality, Privacy) are added based on what you’ve actually committed to in customer contracts.
Should I start with Type I or go straight to Type II?
If you need a report quickly to unblock a deal, Type I can serve as an interim step. If you have time and your controls are already mature, going straight to Type II avoids paying for two separate audit engagements.
Conclusion & Next Steps
A SOC 2 report isn’t a regulatory box to tick – it’s become one of the clearest ways to prove to customers, partners, and procurement teams that your business takes data security seriously. The right starting point depends on your stage: if you’re fielding your first enterprise deal, a Type I report can move things along quickly; if you have the runway, going straight to a Type II report avoids doubling up on audit costs.
Whichever path you choose, the process starts the same way every audit does – with the right auditor and a clear-eyed readiness assessment. If you’re not sure where to begin, our guide to choosing an internal auditor is a useful next read, or explore vetted US audit firms to get quotes from qualified providers.