SOC 2 Compliance: The Complete Guide to Trust Services Criteria, Reports, Cost, and Readiness

SOC 2 is an independent examination performed by a licensed CPA firm that reports on how well a service organization protects customer data. It results in an attestation report, not a certificate, and there is no fixed list of required controls — each organization defines its own controls against the AICPA's Trust Services Criteria in scope.

Reviewed by Dor Israel, Founder · Updated October 21, 2026

Related toolkits: SOC 2 Policy Pack — Core ($59) · SOC 2 Complete Toolkit ($99)

Free: the Change Management Policy template for SOC 2 (Word) →

What is SOC 2?

SOC 2 (System and Organization Controls 2) is a reporting framework from the American Institute of CPAs (AICPA), examined under the SSAE 18 / AT-C 205 attestation standards. It is built on five Trust Services Criteria categories: Security — also called the Common Criteria and always required — plus Availability, Confidentiality, Processing Integrity, and Privacy, which are included only when relevant to your services. Unlike ISO 27001's 93 fixed Annex A controls, SOC 2 has no enumerated control list; you design controls that map to the criteria.

A SOC 2 Type I report assesses whether controls are suitably designed at a single point in time, while a Type II report tests whether they operated effectively over a review period, typically three to twelve months.

The AICPA writes Type II as Type 2. Its illustrative SOC 2 Type 2 report includes management's assertion, the description of the system, the service auditor's report, and the tests of controls with their results. Management prepares the system description against the AICPA's 2018 SOC 2 description criteria (DC 200). Those criteria do not fix a format, so the layout of the description can differ from one report to the next.

Who needs it?

SOC 2 is the dominant trust standard for US and North American B2B SaaS companies, cloud platforms, MSPs, and service organizations that store, process, or transmit their customers' data. It is rarely a legal requirement; instead it is driven by enterprise procurement, where buyers and their security teams send vendor security questionnaires and require a current SOC 2 report before signing. Startups selling upmarket, fintech and healthtech vendors, data processors, and any company whose deals stall in security review are the typical candidates. Organizations needing an internationally recognized certificate, rather than a US-style attestation report, often pursue ISO 27001 alongside or instead of SOC 2.

What does SOC 2 readiness cost?

Typical steps

1. 1. Scope the report — Decide Type I vs Type II and which Trust Services Criteria apply — Security is mandatory; add Availability, Confidentiality, Processing Integrity, or Privacy only if relevant to your service.
2. 2. Document policies and controls — Adopt the information security, access control, change management, incident response, vendor, and risk policies that map to the criteria. This is where editable templates replace writing from a blank page.
3. 3. Run a readiness assessment and close gaps — Compare current practice against your controls, remediate gaps, and assign owners. A consultant, automation platform, or internal lead can drive this.
4. 4. Operate controls and collect evidence — For a Type II, run the controls through the observation window (commonly 3-12 months), gathering tickets, logs, reviews, and approvals as evidence.
5. 5. Engage a licensed CPA firm for the examination — An independent CPA firm performs the audit, tests your controls, and issues the SOC 2 report — the only step that produces the actual attestation.
6. 6. Share, monitor, and renew — Distribute the report under NDA to prospects and customers, monitor controls continuously, and renew with a new Type II examination each year.

Where editable templates fit

The largest and most expensive part of SOC 2 readiness is usually writing the policies and mapping them to the Trust Services Criteria — exactly what ComplianceDocs templates deliver. Our SOC 2 toolkits provide professionally structured, editable Word policies plus an Excel control-mapping workbook aligned to the Security Common Criteria and the optional categories, so a single control activity produces evidence your CPA expects to see. You replace the amber [bracketed placeholders] with your organization's details, operate the controls, and engage an auditor — the templates give you the documentation structure, they do not replace the independent examination or grant any attestation.

Recommended SOC 2 toolkits

Compare SOC 2 with other frameworks

• ISO/IEC 27001 vs SOC 2: Certification or Attestation, Controls, Cost, and Which One You Need

Frequently asked questions

Does buying SOC 2 templates make us SOC 2 compliant or certified?

No. SOC 2 is an independent CPA firm's attestation report, not a certificate, and no document pack confers it. Templates give you the policy and evidence-mapping foundation auditors request first, so your readiness is far cheaper, but the report itself comes only after a CPA examines controls you actually operate.

What does SOC 2 compliance mean?

The AICPA, which sets the professional standards for SOC engagements, describes SOC 2 as "an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy" and calls the result a SOC 2 report. A claim of SOC 2 compliance is therefore backed by that report from a licensed CPA firm, not by a certificate. According to the AICPA, customers and business partners often request a SOC 2 report from the service organization.

How many controls does SOC 2 require?

There is no fixed number. Unlike ISO 27001's 93 Annex A controls, SOC 2 has no enumerated control list — you design your own controls to meet the AICPA Trust Services Criteria in scope. The mandatory Security category (the Common Criteria) anchors every report, with Availability, Confidentiality, Processing Integrity, and Privacy added only when relevant.

What is the difference between a SOC 2 Type I and a Type II report?

A Type I evaluates whether your controls are suitably designed at a single point in time, while a Type II tests whether they operated effectively over a review period, typically three to twelve months. Type II carries more weight with enterprise buyers because it evidences sustained operation, not just design.

How much does SOC 2 cost in total?

Plan for two separate costs. Readiness ranges from template kits at $59-$149 to quote-based automation platforms (Vendr reports median annual contracts of $15,000-$24,934 across Vanta, Drata, Secureframe, and Sprinto, retrieved October 2026), with consultants quoted per scope. The independent CPA examination is a distinct fee on top, commonly $5,000-$60,000+ depending on scope, type, and firm.

Is there a SOC certification, and what are SOC 1, SOC 2, and SOC 3?

SOC reports are not certificates. SOC (System and Organization Controls) is the AICPA's name for a suite of services CPAs offer on an organization's controls, and CPAs use them to issue assurance reports. SOC 1 is an examination of controls at a service organization that are likely to be relevant to its customers' internal control over financial reporting. SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality, or privacy. SOC 3 addresses the same five areas with less detail, so it is a general-use report that can be freely distributed.