SOC 2 for growing businesses

Enterprise customers increasingly want a SOC 2 report before they sign. Deals stall without one, and some RFPs rule out vendors who cannot show it. Here is what SOC 2 is and how to get there without making compliance a full-time job.

What SOC 2 is

SOC 2, or System and Organization Controls 2, is an audit framework from the AICPA, the accountants’ institute. It judges how you manage customer data against five Trust Services Criteria.

It is not a certificate. There is no pass mark and no certifying body. An independent CPA firm examines your controls and writes a report, and your customers read it.

So the report’s worth depends on your controls and on your auditor. Careful customers see through a shallow audit from a cheap firm.

Who needs it

You almost certainly need SOC 2 if you:

• Are a SaaS or cloud provider that stores, processes or sends customer data.
• Hear enterprise prospects ask for the report.
• Answer RFPs that require it.
• Handle financial, health or personal data for clients.
• Have partners or investors who want proof of security.

You may not need it yet if you:

• Handle only your own internal data.
• Sell mainly to consumers.
• Have no one in your pipeline asking for a report.
• Can meet current demands with a Type I report or a security questionnaire.

Getting ahead of the request is an advantage. The company that hands over a Type II report closes faster than the one “working on it”.

The five Trust Services Criteria

Security is always included. The other four are optional, chosen to fit your business.

Criterion	What auditors check	Include it if
Security, required	Access, network security, endpoint protection, change management, incident response, vulnerabilities, training and vendor risk	Always
Availability	Uptime monitoring, disaster recovery, capacity, backup and restore, outage response	You promise uptime or customers run on your platform
Processing integrity	Accurate processing, error handling, quality checks, input and output validation	Customers rely on your transactions, calculations or reports
Confidentiality	Data classification, encryption, access by class, secure disposal, NDAs	You hold client IP, trade secrets or confidential data
Privacy	Privacy notice, consent, access and deletion rights, retention, cross-border transfers	You collect personal data from individuals, under GDPR, CCPA or state laws

Most growing businesses start with Security alone, or Security and Availability. Each criterion adds scope, cost and time, so start with what customers ask for.

Type I or Type II

	Type I	Type II
What it tests	Whether your controls are well designed	Whether they are well designed and work
When	One point in time	A period, typically 6 to 12 months
Think of it as	A snapshot	A film
Timeline	1 to 3 months of preparation	3 to 6 months of preparation, then 6 to 12 months of observation, then the audit
Choose it when	A deal needs a report fast, or this is your first program	Customers ask for Type II, as most enterprises do

Most companies follow four steps.

1. A gap assessment, over one to two months.
2. Remediation of the gaps, over two to four months.
3. Type I, to check control design, over one to three months.
4. Type II, with 6 to 12 months of observation and then the audit.

Mature organisations sometimes skip Type I.

Timeline and cost

From scratch, a Type II report takes 12 to 18 months. With strong security already, it can take 6 to 9.

Stage	Time
Gap assessment	2 to 4 weeks
Remediation	2 to 6 months
Type I audit, optional	1 to 2 months
Type II observation	6 to 12 months
Type II audit and report	1 to 2 months

Cost	Range
Type I audit	$15,000 to $40,000
Type II audit	$25,000 to $75,000
Compliance platform such as Vanta, Drata, Secureframe or Sprinto	$10,000 to $30,000 a year
Remediation with decent security already	$5,000 to $20,000
Remediation from scratch	$30,000 to $100,000 or more
Consulting	$10,000 to $50,000
Upkeep each year	$20,000 to $50,000
First year in total, for 50 people	$60,000 to $200,000

Compliance platforms automate evidence, policies and monitoring, and have made SOC 2 far easier for small companies. A compliance consultant saves time and money by keeping you on what matters.

Common gaps

Access

Access often has no formal process, leavers keep accounts, and admin rights are shared or too broad.

• Tie joining and leaving to HR.
• Review access to critical systems quarterly.
• Grant least privilege.
• Replace shared accounts with personal, auditable ones.
• Use SSO and MFA on every critical system.

Change management

Changes often go live without review, approval or record, and with no separate environments.

• Write a change policy with approval steps.
• Review code before it reaches production.
• Keep development, staging and production separate.
• Log each change with time, approver and description.
• Use automated deployment pipelines with controls built in.

Incident response

There is often no plan, no roles and no communication steps.

• Write a plan with severity levels, roles, escalation and communication.
• Run a tabletop exercise at least yearly.
• Monitor and alert on security events.
• Record a review after each incident and track the fixes.
• Define when to notify lawyers, regulators and customers.

Vendors

Vendors that touch customer data often go unchecked.

• List every vendor that touches customer data.
• Assess each by questionnaire, SOC 2 report or certification.
• Put security terms in contracts.
• Review vendors yearly.
• Watch critical vendors for incidents.

Training

There is often no security training.

• Train every employee yearly.
• Run regular phishing simulations.
• Track completion and results.
• Include security in onboarding.
• Keep records of the program and completions.

Logging and monitoring

Logs are often thin and scattered, with no alerts.

• Turn on audit logs for cloud platforms, apps and network devices.
• Send logs to a SIEM or log platform.
• Alert on failed logins, privilege escalation and unusual data access.
• Keep logs at least a year, since some frameworks ask for more.
• Review logs regularly and investigate anomalies.

Readiness checklist

Policies. Write policies for information security, acceptable use, access control and change management. Add incident response, continuity, data classification, vendors and risk assessment.

Technical controls. MFA on critical systems, EDR on every device and automated patching. Add network security, encryption of customer data, tested backups, central logging and regular vulnerability scans.

Operating controls. Formal joiner and leaver steps, quarterly access reviews and approved changes. Add security training, vendor assessment, a yearly risk assessment, a tabletop test and background checks for staff with system access.

Audit preparation. Configure your compliance platform to collect evidence, and review every policy. Organise the evidence, engage the audit firm, set the Type II window and brief the key people.

Keeping it

SOC 2 needs upkeep after the report.

How often	What
Continuously	Monitor controls, collect evidence automatically, fix exceptions and close past findings
Quarterly	Review access, the risk assessment and vendors, and test a restore
Yearly	Renew the audit, update policies, reassess risk, run a tabletop, train everyone and review scope

How SBK helps

SBK’s compliance practice assesses your gaps and ranks the fixes. It helps close them without over-engineering, prepares the evidence and your people, and keeps the program current.

We work beside your team and your auditor. We recommend the platform and auditor that fit, and take no referral fees.

Our cybersecurity work makes sure the controls behind your report actually work.

Questions people ask

How long does SOC 2 take?

From scratch, 12 to 18 months to a Type II report, or 6 to 9 with strong security already. A Type I report takes 3 to 6 months and can serve in the meantime.

How much does SOC 2 cost?

A 50-person company typically spends $60,000 to $200,000 in the first year. That covers the audit, platform, remediation and consulting. After that, expect $40,000 to $80,000 a year.

Type I or Type II?

Type I checks that the right controls exist at one moment. Type II checks that they work over 6 to 12 months. Most enterprise customers want Type II.

Can we do it without a consultant?

Yes, especially with Vanta, Drata or Secureframe. A consultant saves time by steering you clear of common mistakes and needless controls, and often pays for itself.

What if we fail?

There is no fail grade. An auditor can give a qualified opinion when controls have serious gaps, which warns your customers. Avoid it with a thorough readiness check and close work with your auditor.