What Is SOC 2 Compliance? A Plain-English Guide

SOC 2 in one paragraph

SOC 2 is a security framework created by the AICPA (the American Institute of Certified Public Accountants). It sets out how a service company should protect customer data. A company is "SOC 2 compliant" when an independent CPA firm (a licensed accounting firm) has checked its controls and issued a SOC 2 report. Controls are the rules, tools and habits you use to keep data safe. Customers read the report to decide if they can trust you with their data.

There is no such thing as a SOC 2 certificate. What you get is an attestation report: the auditor's written opinion on your controls. You usually share it with customers and prospects under an NDA (a signed promise to keep it private).

Who needs SOC 2?

Nobody is legally required to have SOC 2. Companies get it because their customers ask for it. It is most common for:

• SaaS companies selling to mid-size and enterprise customers, especially in the US
• Fintech, payments and data platforms that handle sensitive customer information
• Managed service providers, hosting companies and outsourced IT
• Any vendor that keeps losing time on long security questionnaires

In our experience, if a deal is stuck in security review, a SOC 2 report often shortens that review from weeks to days.

The five Trust Services Criteria

A SOC 2 audit checks your controls against the Trust Services Criteria. Security is always included. The other four are optional, and you add them when they matter to your customers.

Most first-time SaaS reports cover Security, often with Availability and Confidentiality added.

SOC 2 Type I vs Type II

Type I checks that your controls are designed correctly at one point in time. It is faster and cheaper. It also gives your sales team something to share quickly.

Type II checks that those controls really worked over an observation period, usually 3 to 12 months. This is the report most enterprise customers ask for.

A common path is Type I first, then a Type II once the observation period ends. Some companies with mature security go straight to Type II.

How long does SOC 2 take?

It depends on how much security you already have in place. A typical timeline for a growing SaaS company looks like this:

1. Gap assessment (2 to 4 weeks): compare what you do today against the criteria.
2. Fixing gaps (1 to 3 months): write policies, turn on logging (records of who did what), tighten access and set up vendor and change checks. Then run a penetration test (a hired expert tries to break in, with your permission).
3. Type I audit (a few weeks): the auditor reviews your control design.
4. Type II observation (3 to 12 months): your controls run and you collect evidence.
5. Type II report: issued a few weeks after the window closes.

Most companies are ready for a Type I within 2 to 4 months of starting.

How much does SOC 2 cost?

There is no fixed price, because every scope is different. The total is made up of a few parts:

• The audit fee charged by the CPA firm. It goes up with scope, the number of criteria and the report type. A Type II costs more than a Type I because the auditor tests controls over months.
• Readiness help from a consultant, if you do not have security staff who have done SOC 2 before.
• Tools, such as compliance software that collects evidence for you, logging and endpoint security (protection on each laptop and server).
• A penetration test, which auditors and customers usually expect to see.
• Your team's time, which is often the biggest hidden cost.

The cheapest SOC 2 is one with a tight scope. Include only the systems that handle customer data. Add only the criteria your customers ask for. This keeps both the audit fee and the prep work down.

SOC 2 vs ISO 27001

SOC 2 is an attestation report, most valued by US customers. ISO 27001 is a certificate against an international standard. It is more common in the UK, Europe and Asia. The controls overlap a lot, so many companies do one first and add the other later with much less effort. Sell mainly to US enterprises? Start with SOC 2. Sell mainly in Europe? ISO 27001 may open more doors.

How NextGarrison helps

We get you ready for the audit: scope, gap check, policies, putting controls in place, evidence and the penetration test. We then work alongside your chosen CPA firm until the report is issued. We are not a CPA firm and do not issue SOC 2 reports ourselves. Keeping prep and audit separate is exactly how SOC 2 is meant to work.

Want to know whether a penetration test is required? Read Does SOC 2 require a penetration test?