SOC 2 Certification: What It Is, How to Get SOC 2 Compliant, and What It Costs

Is SOC 2 a certification?

SOC 2 is not a certification: the AICPA describes it as a report from an examination of controls at a service organization, performed by a CPA. Nobody hands you a certificate. A CPA firm examines your controls and issues a report with its opinion, and your customers read that report.

People still say “SOC 2 certified” and “SOC 2 compliant”. In practice both mean the same thing: the company holds a current SOC 2 report with a clean (unqualified) opinion. Ask any vendor that claims it for the report itself, its type and its period.

SOC 2 requirements: the 5 Trust Services Criteria

SOC 2 requirements come from the AICPA’s Trust Services Criteria, which group controls into five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. The current criteria are the 2017 set with points of focus revised in 2022.

Secureframe puts it plainly: Security is the only criterion every SOC 2 audit requires. Add the others only when your customers or contracts ask for them, because each one widens the audit.

SOC 2 Type 1 vs Type 2

A SOC 2 Type 1 report checks whether your controls are designed correctly on a single date, while a Type 2 report tests how those controls operated over a period, usually three to twelve months, according to Vanta. A Type 2 costs more because it covers a window and involves more testing. SOC 1 and SOC 3 are different reports in the same AICPA family (see SOC 1 vs SOC 2). Our full Type 1 vs Type 2 comparison sets out the cost, the timeline and which to get first.

How to get SOC 2 certified: 6 steps

You get a SOC 2 report by preparing your controls, then hiring a CPA firm to examine them. Six steps cover it:

1. Set the scope. Pick the systems, the teams and the criteria (Security, plus any of the other four your customers want).
2. Run a readiness (gap) assessment. Compare what you do today with the criteria. A consultant or compliance software can do this.
3. Fix the gaps. Typical work: written policies, MFA everywhere, logging, access reviews, vendor reviews, security training and an incident plan.
4. Choose a CPA firm. See the auditor checks below.
5. Run the observation window (Type 2 only). Your controls must operate, with evidence, for three to twelve months.
6. Get the report, then repeat yearly. Vanta calls SOC 2 an annual commitment: a new audit every year.

Compliance software helps with steps 2, 3 and 5. To compare tools by published price, see our GRC software comparison, or our Vanta vs Drata comparison for two of them.

How long SOC 2 takes

A first SOC 2 Type 2 report takes roughly 4 to 17 months from a standing start by our arithmetic: Vanta’s one to five months of preparation plus a three- to twelve-month observation window, before fieldwork and the report.

A shorter window gets you a report sooner. Buyers can see the window length on the report, so a three-month window is a smaller proof than a twelve-month one.

How much SOC 2 certification costs

SOC 2 costs $10,000–$80,000 or more in the first year all-in, according to Vanta, and the CPA firm’s audit fee alone runs $10,000–$50,000.

Every range here comes from a company that sells SOC 2 software, so read them as vendor-stated estimates, not quotes. The software never includes the CPA firm’s fee: budget for both, as our SOC 2 compliance cost breakdown does.

SOC 2 compliance checklist

A SOC 2 compliance checklist is the short list of controls and documents an auditor will ask to see. Use this one to check readiness before you book an auditor:

• Scope statement: systems, data, teams and the criteria you’re including
• System description: what your service does and how data flows
• Written security policies, approved and dated
• Risk assessment, reviewed in the last year
• MFA on email, cloud consoles, code repositories and admin tools
• Joiner, mover and leaver process, with access reviews
• Central logging and alerting, with an owner who reviews alerts
• Change management: code review and approval before production
• Vendor list, with security reviews of critical vendors
• Encryption of data in transit and at rest
• Backups and a tested recovery plan
• Incident response plan, with one practice run
• Security awareness training for every employee, with records
• Background checks where the law allows them

How to choose a SOC 2 auditor

Choose a SOC 2 auditor by checking that it’s a licensed CPA firm, reading its results in the AICPA peer review public file search and asking how it tests your controls. The Journal of Accountancy reported in February 2026 that the AICPA SOC 2 Working Group’s chair warned that “fast and easy” reports may sacrifice quality and objectivity. To shortlist firms, compare SOC 2 auditors by peer review, services and published price.

Do you need SOC 2? (Is it legally required?)

You need SOC 2 when your customers ask for it, not because a law says so: SOC 2 is an AICPA attestation standard, and the demand comes from security reviews and contracts.

SOC 2 fits a SaaS or service company that stores or processes customer data and sells to businesses with security questionnaires.

Skip it for now if you sell only to consumers, or if no customer or prospect has asked for a report. Spend the money on the controls instead.

ISO/IEC 27001 is the main alternative. ISO 27001 is a certifiable international standard, so an accredited certification body issues an actual certificate; our ISO 27001 vs SOC 2 comparison puts the two side by side. Companies building AI products may also need ISO 42001, the AI management system standard.