Deciding, scoping, budgeting and starting. Once you're in the audit, the playbook covers the rest.
← Back to overviewNot a certification. It's an audit report from a CPA saying you defined some policies and (maybe) followed them. It measures whether you follow documented processes — not whether you'd survive an attack. Companies as small as 3 people have done it.
Point-in-time. Controls exist and are suitably designed, as of one date.
3-12 month window. Controls operated effectively, every time, sampled.
Type I first? Treat it as a dress rehearsal, not a lesser certificate — it forces your policies, evidence trail and auditor relationship to exist before the Type II clock starts. One 8-person startup went from first policy review to as-of date in five weeks. If most prospects require Type II and your controls are stable, go straight to a short three-month Type II instead of paying twice.
And you pick the cadence. The criteria never say "quarterly." Say quarterly and a 12-month Type II needs four documented cycles with sign-off. Say annual and it needs one. Annual is auditor-acceptable and it's what a small team actually does.
| Category | Take it? |
|---|---|
| Security | Always. This is the Common Criteria. |
| Confidentiality | If you hold client matters, PHI, financial records or proprietary business information. Standard for professional services. |
| Availability | Only if you have contractual uptime SLAs. |
| Processing Integrity | Only for financial calculation, payments, tax prep. |
| Privacy | Only if consumer-facing with significant PII. Doesn't satisfy HIPAA. |
Every third party material to delivering your service goes in the system description, designated carve-out (their controls excluded; your report tells customers to read their SOC report) or inclusive (tested by your auditor). Carve-out is right for virtually every startup.
| Opinion | Meaning |
|---|---|
| Unqualified | Clean. What "passed" means. Routinely still contains documented exceptions — that's normal and still sells. |
| Qualified | A material departure confined to one area. Still issued, still usable; you'll explain it in every security review. |
| Adverse / disclaimer | Essentially only happens to companies that walked in unprepared. |
Four to twelve months, depending on where you're starting.
Scoping: in scope is anything that stores, processes or transmits customer data, plus identity, logging and backup. Out: dev/staging without production data, internal-only systems, the marketing site. Gray: CI/CD that deploys to production (usually in), internal wikis (in if they hold customer matters). If you're remote, don't scope an office.
Configuration, not procurement. For choosing between products and price points, see What You Actually Need.
| Turn on | Where |
|---|---|
| MFA enforcement | Google Workspace: Admin → Security → 2-Step Verification → Enforcement. Microsoft: security defaults are free and enforce MFA for everyone; Conditional Access needs Entra ID P1 or Business Premium. |
| Cloud audit logging | CloudTrail across all regions, GCP Cloud Audit Logs, or Azure Activity Log. On GCP, Data Access logs are off by default and are usually the ones you'll be asked for. Enable early — you can't backfill. |
| Encryption | On by default nearly everywhere. Your job is to verify it and capture the screen, not to configure it. |
| Branch protection | Require a reviewed, approved PR on your default branch. This single setting carries most of CC8.1, and the PRs become the change records. |
| Policy templates | Tailscale (start here) or JupiterOne — then trim hard. |
| Policy signatures | PandaDoc's free tier, or a typed name and date in a tracked sheet. Auditors accept both. |
Four things per control: the policy, evidence people were told, the procedure, and proof it operated. The artifact set, register schemas and why a zero-row log is evidence →
Expect: "Walk me through how a new employee gets access." "Show me a change from request to deployment." Controls must work every time, not just when you're watching. What they actually ask, and what answers work →
A Type II covers a stated period and reads as stale about 12 months after it ends. Bridge letters buy limited time. Renewal runs roughly 40% of year one.
SOC 2 is criteria-based, not tool-based. Every row below has three ways to satisfy the same criterion: do it by hand, buy the cheap business-grade product, or buy the incumbent. The manual column is viable at ~10 people and painful at 25+.
| Need | TSC | Free or manual | Cheap paid option | Buy the incumbent when |
|---|---|---|---|---|
| Identity / SSO Okta, JumpCloud |
CC6.1-6.3 | Google Workspace or M365 as your IdP, with per-app access lists and documented on/offboarding. | Entra ID P1 $7/user/mo. Or M365 Business Premium at $22/user/mo, which bundles Entra P1, Intune and Defender for Business — often cheaper than buying the three separately. | 15+ apps, or offboarding takes over an hour |
| Anti-malware / EDR CrowdStrike, SentinelOne |
CC6.8 | Windows Defender, macOS XProtect + Gatekeeper. Document that they're on and auto-updating. | Defender for Business $3/user/mo, no device minimum. CrowdStrike Falcon Go $7.99/device/mo, buy online, caps at 100 devices. | Sensitive data, or a customer asks by name |
| MDM Jamf, Kandji, Intune |
CC6.1, 6.6, 6.7 | Acceptable use policy requiring disk encryption and screen lock, a device inventory, periodic screenshots. | Mosyle Business free to 30 devices — the best-value row in this table for a Mac shop. Paid tiers have a 30-licence floor. Fleet is free self-hosted, $7/host/mo managed. | 15+ devices or BYOD |
| GRC platform Vanta, Drata, Secureframe |
n/a | Drive folders and an evidence index spreadsheet. Genuinely works with discipline. | Strike Graph Launch has a free core tier covering Security-only SOC 2. ComplyJet starts around $4k/yr. The big three don't publish pricing at all — every quote needs a sales call. | 15+ people or 10+ integrations. Also lowers audit fees. |
| Log monitoring Splunk, Datadog Security |
CC7.1, 7.2 | CloudTrail + CloudWatch alarms, or Cloud Audit Logs + Monitoring. Alert on IAM changes, key creation, root usage. | Blumira Detect $12/employee/mo with unlimited ingest. Worth saying plainly: most startups at this size don't need a SIEM, and cloud-native alerting is the right answer. | Multi-cloud, or you need cross-source correlation |
| Vulnerability scanning Qualys, Tenable, Rapid7 |
CC7.1 | Trivy, Dependabot, Prowler on a schedule with remediation tracked. These scan code and config, not your running attack surface — don't label them external scanning. | Aikido free for 2 users and 10 repos, $300/mo beyond. Intruder has a free tier covering 5 web apps. Nessus Professional is $4,790/yr — real, but a big jump. | Large attack surface or multiple prod environments |
| Secrets management HashiCorp Vault |
CC6.1 | SSM Parameter Store or GCP Secret Manager, plus TruffleHog to prove nothing's in the repo. | GCP Secret Manager is effectively free at startup volume (~$0.06 per secret version per month after a free allowance). Infisical free to 5 identities; Doppler free to 3 users then $8/user/mo. | 10+ engineers or frequent rotation |
| Security training KnowBe4 |
CC1.4, CC2.2 | Deliver it yourself and keep a completion record with dates. The criterion is that people were informed of their responsibilities, not that you bought a course. | Wizer has a genuinely free self-serve tier. Riot is $6.89/employee/mo. KnowBe4 and Wizer's paid tier both need 25 seats. | You want phishing simulations and automated reporting |
| Background checks Checkr, HireRight, Sterling |
CC1.4 | The criterion says the entity "considers background screening" — not performs. A documented per-role screening decision, reference checks and recorded rationale satisfies it. | Checkr from $29.99/report, no platform fee and no minimum, so you can run one when a role genuinely warrants it. | Admin access to sensitive systems, or regulated customers |
| Penetration test | CC4.1, CC7.1 | Arguable, not settled. Points of focus are illustrative and CC4.1 lists pen testing in a menu, so structured periodic evaluation can satisfy it — but declining the obvious artifact means paying the rigor price: methodology, scope matching your boundary, schedule, written output, tracked remediation, recorded as risk acceptance. | Call a boutique and tell them plainly what your budget is and what you need it for. Timeboxed to a week or less, a broad security assessment or cloud configuration review — product, infrastructure, code and org posture in one formal report — buys more at this stage than a narrow deep-dive on one endpoint. The written report is the artifact that does the work, for the criterion and for the buyer asking. | Buyers ask regardless. "Not now," not "not ever." |
Prices and seat minimums change — check both before budgeting.
| Control | TSC | Note |
|---|---|---|
| MFA everywhere | CC6.1 | No compensating control exists for "we don't use MFA." Free. |
| Cloud audit logging | CC7.1, 7.2 | Cannot be generated retroactively. Enable it today. |
| Encryption at rest and in transit | CC6.1, 6.7 | Mostly default. Verify and screenshot. |
| Documented policies | CC1.1, 2.1, 5.1 | No policies means nothing to audit against. |
| Periodic access reviews | CC6.2, 6.3 | Checked every time. You set the frequency; then you owe every cycle. |
| Change management | CC8.1 | Ticket, review, deployment record. Need 3+ months. |
| Risk assessment | CC3.1, 3.2 | Likelihood, impact, treatment, owner — and a written justification per score. |
| Incident response plan | CC7.3, 7.4 | For a Type I the exercise needs to be scheduled, not yet performed. A Type II wants one actually run inside the window. |
The non-negotiables are nearly all free. The cost is the audit and your time.
At a small company these are the same two or three people. What matters is that each job has an owner.
| Role | When | Owns |
|---|---|---|
| Compliance owner | Throughout | Scope, policies, platform and auditor selection, evidence, auditor liaison. |
| Engineering / DevOps | Months 1-5 | Architecture docs, logging, vulnerability management, CI/CD controls, restore testing. |
| IT / sysadmin | Months 1-3, then ongoing | IdP, provisioning and deprovisioning, access reviews, endpoints, asset inventory. |
| HR / People Ops | Per hire | On/offboarding records, acknowledgments, training, the documented screening decision. |
| Founders | Budget, then interviews | Policy approval, risk acceptances, management responses. At a founder-run company they are the board oversight — say so rather than mapping filler to a governance criterion. |
Complexity sets the audit and remediation cost; headcount sets platform seats and how many people the auditor samples. A 10-person fintech running microservices spends more than a 100-person monolith shop — and pays less for seats. Both are real, they just move different lines.
| Tier | You're probably here if | First-year total |
|---|---|---|
| Simple | One production app, one cloud account, no regulated data. Usually under 10 people. | $12k–$55k |
| Moderate | Two to five services, or a data warehouse alongside your app database, or a second cloud. Regulated-adjacent — fintech, healthtech — without a HIPAA or PCI obligation. Commonly 10–40 people. | $55k–$110k |
| Complex | Microservices, multi-region, several environments, or enterprise customers who audit you directly. | $100k–$200k |
| Highly complex | Multi-cloud or on-prem, or a HIPAA/PCI obligation layered on top of SOC 2. | $180k–$450k+ |
Ranges below are for the Simple tier, because that's the one people ask about. Above Simple the platform and audit lines roughly double, and remediation stops being optional.
| Line | Range | What moves you along it |
|---|---|---|
| GRC platform | $6k-25k | $6-10k/yr for a single framework under 10 people; seats scale with headcount. Skip it if your documentation habits are strong. |
| External audit | $5k-25k | Boutiques: Type I $3-6k, Type II $5-8k, often discounted if you're on a platform. |
| Readiness help | $8k-20k | The low end is a few days of advice where you write the documents. The high end is someone writing the system description, the policies and the gap assessment for you. Which one you need depends on whether you have the hours, not on how big you are. |
| Remediation | $0-25k | Missing from most budget pages because most teams fix their own gaps. Budget it if you have no internal security function — someone still has to implement what the assessment finds. Usually quoted as a day rate, not a lump sum, so ask for one. |
| Pen test or security assessment | $10k-40k | Not strictly required. Simple web app $9-15k; app + API + cloud review $15-30k+. A timeboxed assessment scoped as a broad review rather than a deep-dive comes in lower and produces the same report. |
| Year one | $12k-80k | Under $20k is achievable for a small single-app company: platform, boutique auditor, advice-only consulting. It is not the number for a Moderate-tier company, and a quote above it isn't automatically wrong — check which tier you're in first. |
| Year two | $10k-40k | You're maintaining, not building. Year one is the painful one. |
This matters more than platform choice. You'll work with them for months.
| Firm | Cost | Trade-off |
|---|---|---|
| Big 4 | $100k+ | Brand recognition. Expensive, slow, junior staff doing fieldwork. Post-Series C selling to Fortune 500. |
| Regional | $20k-50k+ | Solid and reasonably priced. Variable startup experience. |
| Boutique | $3k-15k+ | Partners involved, fast, understand lean teams. Less brand recognition, which most customers don't care about. |
Ask in your RFP: how many Type IIs in the last 12 months; who actually does the fieldwork (names); clients on a similar stack; typical kickoff-to-report time; how they handle mid-audit remediation; references from companies your size. And one more — will you flag potential exceptions during fieldwork, or do we first see them at report draft? You want no surprises: an exception you fix after discovery generally can't be re-tested until the next cycle.
Consultants fix things; auditors evaluate them. Consultants write gap analyses, design controls and draft policies — no CPA licence needed. Auditors test evidence and issue the opinion, and cannot help you fix what they find. Use different firms.
Outside help pays in three places: a readiness assessment if you've never done this; a review of your system description if your architecture is genuinely complex; and implementing gaps you lack the in-house skills for. Separately from compliance — a scoped pen test, phishing-resistant auth and a credential audit are worth doing on their own merits.
A red dashboard is not a finding — auditors evaluate controls, not your score. How to triage one →
Good at: drafting policies, adapting templates, mapping controls to criteria, gap analysis, evidence checklists, system description drafts.
Bad at: reciting the TSC accurately (paste the criteria text in), knowing your budget or scope, current vendor pricing, and predicting what your auditor accepts. It will recommend everything — always ask "is this actually required for my scope?"
Every vendor publishes policy-drafting prompts. This one catches the failure mode that actually costs you: promising something you can't evidence.
Give it real context — headcount, what you sell, who your customers are, your stack, the TSC you scoped, and why you're doing this at all. Without that a model will design a program for a 500-person company. Tell it to cut, not to add.
And keep the two goals apart. A tight SOC 2 makes you auditable; it does not make you hard to attack. Controls worth having for their own sake belong on your security roadmap, not padded into your policy set where every one becomes something to evidence forever.
Pre-PMF companies waste money and slow development. Wait until it blocks enterprise deals.
"Immediately" for offboarding. Quarterly for anything. A 4-hour RTO. Every number you write is a number you're tested against.
Your platform generates ~21 enterprise policies describing a company you aren't. Replace them.
Office WiFi when you're remote. Availability when no customer asked. Start Security-only.
You can't backdate. Access reviews, change history and audit logs are calendar time you can't compress.
The platform doesn't handle it. Expect ~8 hours a week from your core team for 6-8 weeks.
Finding 15 gaps and starting the audit next week. Budget weeks or months.
Auditors want evidence you assessed vendors, not that you collected PDFs. Half of them have period gaps or carve-outs that matter to you.
Enabling audit logs a month before the audit. Type II needs months of history.
There's no pass or fail — you get one of four opinions, and the verdict that affects your deals comes later, from your customer.
One timing rule catches people: fix an exception after it's found but before issuance and the auditor generally can't re-test it. It stays in the report, and Section 5 is your only lever.
Where the real gate is: 38% of organizations have had a report rejected by a customer or prospect (A-LIGN 2024 Compliance Benchmark, ~700 respondents). A narrowly scoped clean report can be worth less than a broader one carrying a minor exception. Sort gaps by "would a buyer care," not by dashboard color.
Be skeptical of anyone quoting a SOC 2 "pass rate." No such statistic exists — reports are confidential and aren't centrally registered.
Spreadsheets genuinely work for a 5-person team with simple infrastructure and good documentation habits. Past that, the manual hours cost more than the platform, and auditors work faster with one. Get a platform when you're scaling.
A lot in month one — MFA, logging, access controls, documenting data handling. After that the security lead spends a few hours a week and everyone else spends almost nothing. The observation window is light; you're just operating what you built.
Probably not. It depends on deal size, not headcount. Under $2M ARR an internal owner plus a tool handles it in ~2 days a month. At $2-10M ARR, or $200k+ deals, customers send detailed questionnaires and want security calls — that's when a fractional advisor starts to pay. Hire when security questions start costing you revenue.
Easier. No badges, visitor logs or camera systems to evidence. Your scope is cloud infrastructure, endpoints and network access. Replace the template's data-center physical security policy with one honest paragraph.
Yes, but shared infrastructure gets pulled in regardless of what your description says — cloud accounts, identity provider, CI/CD, logging, and anyone with cross-product access. You can't claim access controls are effective for Line A while Line B's people have equivalent access through the same mechanism.
Either accept the shared layer (simpler) or make the boundary real with separate accounts, IAM groups and pipelines. Arbitrary lines through shared infrastructure create credibility problems.
We do readiness assessments, AI red teaming, app penetration testing, and general "am I doing this right" support for SaaS companies selling into enterprise markets.
Get in Touch