SOC 2 Compliance: The Complete Guide to Trust Services Criteria, Reports, Cost, and Readiness
SOC 2 is an independent examination performed by a licensed CPA firm that reports on how well a service organization protects customer data. It results in an attestation report, not a certificate, and there is no fixed list of required controls — each organization defines its own controls against the AICPA's Trust Services Criteria in scope.
What is SOC 2?
SOC 2 (System and Organization Controls 2) is a reporting framework from the American Institute of CPAs (AICPA), examined under the SSAE 18 / AT-C 205 attestation standards. It is built on five Trust Services Criteria categories: Security — also called the Common Criteria and always required — plus Availability, Confidentiality, Processing Integrity, and Privacy, which are included only when relevant to your services. Unlike ISO 27001's 93 fixed Annex A controls, SOC 2 has no enumerated control list; you design controls that map to the criteria. A SOC 2 Type I report assesses whether controls are suitably designed at a single point in time, while a Type II report tests whether they operated effectively over a review period, typically three to twelve months.
Who needs it?
SOC 2 is the dominant trust standard for US and North American B2B SaaS companies, cloud platforms, MSPs, and service organizations that store, process, or transmit their customers' data. It is rarely a legal requirement; instead it is driven by enterprise procurement, where buyers and their security teams send vendor security questionnaires and require a current SOC 2 report before signing. Startups selling upmarket, fintech and healthtech vendors, data processors, and any company whose deals stall in security review are the typical candidates. Organizations needing an internationally recognized certificate, rather than a US-style attestation report, often pursue ISO 27001 alongside or instead of SOC 2.
What does SOC 2 readiness cost?
| Option | Typical cost | Time to ready |
|---|---|---|
| ComplianceDocs SOC 2 templates (editable policies + control mapping) | $59-$149 one-time | Documentation ready in days; readiness work continues |
| Compliance automation platform (Vanta, Drata, Secureframe, etc.) | ~$7,000-$30,000/yr | Weeks to months to integrate and collect evidence |
| Consultant or vCISO to build and run the program | ~$1,250-$2,750+ (engagements scale higher) | Several weeks to a few months |
| Independent CPA examination (the SOC 2 report itself — required on top of any route above) | ~$5,000-$60,000+ depending on scope and firm | Weeks for Type I; 3-12 month observation window for Type II |
Typical timeline
- 1. Scope the report — Decide Type I vs Type II and which Trust Services Criteria apply — Security is mandatory; add Availability, Confidentiality, Processing Integrity, or Privacy only if relevant to your service.
- 2. Document policies and controls — Adopt the information security, access control, change management, incident response, vendor, and risk policies that map to the criteria. This is where editable templates remove weeks of writing.
- 3. Run a readiness assessment and close gaps — Compare current practice against your controls, remediate gaps, and assign owners. A consultant, automation platform, or internal lead can drive this.
- 4. Operate controls and collect evidence — For a Type II, run the controls through the observation window (commonly 3-12 months), gathering tickets, logs, reviews, and approvals as evidence.
- 5. Engage a licensed CPA firm for the examination — An independent CPA firm performs the audit, tests your controls, and issues the SOC 2 report — the only step that produces the actual attestation.
- 6. Share, monitor, and renew — Distribute the report under NDA to prospects and customers, monitor controls continuously, and renew with a new Type II examination each year.
How editable templates speed this up
The longest and most expensive part of SOC 2 readiness is usually writing the policies and mapping them to the Trust Services Criteria — exactly what ComplianceDocs templates deliver. Our SOC 2 toolkits provide professionally structured, editable Word policies plus an Excel control-mapping workbook aligned to the Security Common Criteria and the optional categories, so a single control activity produces evidence your CPA expects to see. You replace the amber [bracketed placeholders] with your organization's details, operate the controls, and engage an auditor — the templates accelerate documentation, they do not replace the independent examination or grant any attestation.
Recommended SOC 2 toolkits
SOC 2 Policy Pack — Core
15 editable SOC 2 policies mapped to the Trust Services Criteria — the document set your auditor asks for first.
SOC 2 Complete Toolkit
22 policies plus the risk register, full Trust Services Criteria mapping and audit evidence checklist — built for startups facing their first SOC 2.
ISO 27001 + SOC 2 Dual Toolkit
47 documents covering both frameworks plus a control crosswalk, risk register, Statement of Applicability and TSC mapping — run one security program, pass two audits.
Startup Trust Pack — SOC 2 + AI Governance
25 editable documents bundling the SOC 2 Core policy set with the full AI Governance pack — answer enterprise security questionnaires AND the new AI-policy questions in one purchase.
Compare SOC 2 with other frameworks
Frequently asked questions
- Does buying SOC 2 templates make us SOC 2 compliant or certified?
- No. SOC 2 is an independent CPA firm's attestation report, not a certificate, and no document pack confers it. Templates give you the policy and evidence-mapping foundation auditors request first, so your readiness is faster and far cheaper, but the report itself comes only after a CPA examines controls you actually operate.
- How many controls does SOC 2 require?
- There is no fixed number. Unlike ISO 27001's 93 Annex A controls, SOC 2 has no enumerated control list — you design your own controls to meet the AICPA Trust Services Criteria in scope. The mandatory Security category (the Common Criteria) anchors every report, with Availability, Confidentiality, Processing Integrity, and Privacy added only when relevant.
- What is the difference between a SOC 2 Type I and a Type II report?
- A Type I evaluates whether your controls are suitably designed at a single point in time, while a Type II tests whether they operated effectively over a review period, typically three to twelve months. Type II carries more weight with enterprise buyers because it evidences sustained operation, not just design.
- How much does SOC 2 cost in total?
- Plan for two separate costs. Readiness ranges from template kits at $59-$149 and consultants around $1,250-$2,750+ to automation platforms at roughly $7,000-$30,000 per year. The independent CPA examination is a distinct fee on top, commonly $5,000-$60,000+ depending on scope, type, and firm.