A SaaS company in the healthcare data space was nine months into enterprise sales conversations when the prospect's procurement team sent a vendor security questionnaire. Near the bottom: "Please provide your most recent SOC 2 Type II report." The deal went on hold. The sales team had never heard of SOC 2 before that moment. Six months and a significant engagement with an auditor later, they had the report — and the contract. This guide is the roadmap they wished they'd had before that conversation.
What SOC 2 Actually Is (and Is Not)
SOC 2 (System and Organization Controls 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates a service organization's controls against one or more of five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. For most SaaS companies, the Security criterion (also called Common Criteria) is the only required one; the others are optional and added based on your customers' needs and what your platform promises to deliver.
SOC 2 is not a certification in the traditional sense — it's an auditor's opinion on the design and operating effectiveness of your controls. There is no pass/fail. There are no certified auditors who stamp a badge. The output is a formal report, typically 50-100 pages, from a licensed CPA firm that has reviewed your systems, policies, and evidence. Enterprises want this report because it's independently validated, not self-assessed.
Type I vs Type II: Understanding the Difference Early
This distinction matters before you scope your engagement.
- SOC 2 Type I: An assessment of whether your controls are designed appropriately at a single point in time. Faster to obtain (typically 2-3 months), lower cost, but less trusted by sophisticated enterprise buyers. Useful as a stepping stone.
- SOC 2 Type II: An assessment of whether your controls were operating effectively over a defined period — typically a minimum of six months, often twelve. This is what enterprise procurement teams and investors are asking for when they ask for "SOC 2."
A common strategy is to get Type I first (to unblock near-term deals while building operating history), then pursue Type II in the following audit period. If your enterprise pipeline is strong enough to justify the investment, going directly to Type II saves time overall — you just need to wait out the observation window before the report is issued.
Step 1 — Define Your Scope
Scope is the most consequential decision in SOC 2 readiness. It defines which systems, people, processes, and physical locations fall within the audit boundary. Audit scope also determines cost — both the auditor's fee and the internal remediation effort.
Scope decisions to make early:
- Which Trust Services Criteria? Security is standard. Availability is frequently requested by customers whose operations depend on your uptime SLAs. Confidentiality is relevant if you process sensitive documents or proprietary business data.
- Which systems and infrastructure? Typically: your production environment (cloud accounts, databases, application servers), your code repositories, your CI/CD pipeline, and your operational tooling (monitoring, alerting, ticketing). Development laptops and staging environments are sometimes included.
- Which business processes? Logical access management, change management, incident response, vendor management, and risk assessment are the core categories that almost always apply.
Work with your auditor or a readiness consultant to define scope before any remediation work begins. Over-scoping inflates audit costs and internal effort. Under-scoping risks a qualified opinion or a report that customers don't find credible.
Step 2 — Run a Readiness Assessment (Gap Analysis)
Before writing a single policy, understand exactly where you stand against the controls your auditor will evaluate. A readiness assessment maps your current state against the AICPA's Common Criteria and produces a prioritized list of gaps.
Typical gaps found at companies running their first SOC 2:
- No formal risk assessment process or documented results
- Access reviews for production systems not performed on a defined schedule
- Offboarding procedures undocumented or inconsistently followed
- Vendor risk management either absent or limited to informal checks
- Change management process exists but isn't consistently documented (no ticket or approval trail for production changes)
- Security awareness training either not given or not tracked for completion
- Encryption in transit and at rest not consistently enforced across all in-scope systems
The readiness assessment output becomes your remediation roadmap. Most companies need three to six months to close readiness gaps before the audit observation window begins — plan for this in your timeline.
Step 3 — Build Your Control Environment
Controls are the specific activities, tools, and processes that demonstrate your organization is managing risk appropriately. SOC 2 auditors evaluate controls at two levels: design (does this control exist and is it designed to address the risk?) and operation (is there evidence the control ran as designed over the audit period?).
Policy and documentation controls
You need written policies covering information security, access management, incident response, change management, vendor management, and acceptable use. These don't need to be long — they need to accurately describe what you actually do, not an aspirational version, and be reviewed annually.
Technical and process controls
- MFA enforced on all production system access and for all employees
- Encryption at rest and in transit across all in-scope systems
- Logging and monitoring for production systems, with alerts on anomalous activity
- Vulnerability scanning on a defined schedule; external penetration test annually
- Secrets management — no credentials in code repositories or unencrypted config files
- Quarterly access reviews: certify that current access for each user is still appropriate
- Change approval workflow: production changes require a ticket, peer review, and documented approval
- Annual security awareness training with tracked completion
Step 4 — Collect and Manage Evidence
Evidence collection is what most first-timers underestimate. Your auditor needs proof that controls ran during the audit period — screenshots, exported reports, signed documents, system logs, access review records, and ticketing system exports. Building this library manually from a year's worth of records is painful.
A compliance automation platform (Vanta, Drata, Secureframe) integrates with your cloud providers, repositories, identity systems, and HR tools to collect evidence automatically. Typical cost: $10,000–$30,000 per year. Start collecting from day one of your observation window — evidence predating it is generally excluded.
Step 5 — Select and Engage Your Auditor
Only licensed CPA firms can issue SOC 2 reports. The audit firm market ranges from the Big Four (for enterprise-facing companies where auditor brand matters to customers) to specialized mid-market firms focused on technology companies. Costs typically range from $15,000–$50,000 for a Type II audit, depending on scope complexity and firm tier.
Practical advice: engage your auditor during or immediately after the readiness assessment phase, not at the end of the observation window. Auditors book out months in advance. Early engagement also lets the auditor provide informal guidance on control design — though they cannot design controls for you without compromising independence.
Timeline Summary
| Phase | Duration | Key Outputs |
|---|---|---|
| Scope definition | 2–4 weeks | Scope document, Trust Services Criteria selection |
| Readiness / gap assessment | 3–6 weeks | Gap report, remediation roadmap |
| Remediation | 3–6 months | Policies, technical controls, process controls in place |
| Observation window | 6–12 months | Evidence collection, controls operating as designed |
| Audit fieldwork | 4–8 weeks | Auditor testing, Q&A, draft report |
| Report issuance | 2–4 weeks | Final SOC 2 Type II report |
Total elapsed time from "we've decided to pursue SOC 2" to "we have a Type II report in hand" is typically 12–18 months for a first-time engagement. Annual renewals are faster once the control environment is established.
Frequently Asked Questions
How much does SOC 2 cost in total?
Expect $40,000–$120,000 in total first-year spend when you include: internal staff time, external readiness consulting (if used), compliance automation tooling, any technical remediation work (penetration test, tooling, infrastructure changes), and the audit fee itself. Ongoing annual costs are lower — primarily the audit renewal fee and tooling subscriptions. These numbers vary significantly with company size and scope complexity.
Do we need SOC 2 to sell to US enterprises?
Not universally, but it has become close to standard for B2B SaaS companies selling to US mid-market and enterprise accounts, particularly in regulated industries. Healthcare buyers may additionally require HIPAA compliance. Financial services buyers may require additional certifications. In practical terms, lacking a SOC 2 report eliminates you from many RFPs and procurement processes without discussion.
Can a startup outsource its engineering and still achieve SOC 2?
Yes, and it's common. When engineering work is performed by an offshore or nearshore development partner, the auditor will ask about the controls applied to those third parties — subservice organizations in SOC 2 terminology. Your vendor management policy needs to address how you assess and monitor them, and you'll need either your own overlapping controls or documentation of the partner's own SOC 2 or equivalent controls. This is entirely manageable with proper documentation and the right partner agreements in place.
What happens if the auditor finds exceptions?
An exception occurs when a control didn't operate as described during the audit period — for example, evidence shows that two user accounts weren't deprovisioned within the required timeframe. Exceptions appear in the report with management's response. A report with minor exceptions is still accepted by most enterprise customers, provided the exceptions are limited and management responses are credible. Pervasive or material exceptions can result in a qualified opinion, which is more seriously problematic.
This is the kind of work our team handles every day — learn more about our cybersecurity services and secure cloud & DevOps.
Building a SOC 2-ready organization alongside your product takes engineering bandwidth you may not have to spare. Mexilet Technologies partners with SaaS companies as their backend development and infrastructure team — handling the technical controls implementation, cloud security configuration, and documentation work that feeds your compliance program, while your core team stays focused on product. Let's talk about where you are in your compliance journey and how an experienced offshore engineering partner can accelerate it.