Skip to content

Security · AICPA

SOC 2 (AICPA Trust Services Criteria)

The report enterprise and government buyers ask for before they sign. A Type II report gives an auditor’s opinion on controls that ran over an observation period, usually 3 to 12 months.

Take the 3-minute Cyber Hygiene Test

Rather skip the call? Get a fixed-fee SOC 2 quote in writing.

One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing

Who it applies to

The businesses that carry SOC 2, and the pages written for them.

Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.

Financial ServicesLaw FirmsAccounting & Tax FirmsAI & Technology CompaniesArchitecture, Engineering & ConstructionAgencies, Staffing & Consultancies

Which packages prepare you for it

SOC 2 Readiness: Type 1 and Type 2

SaaS, AI and technology companies of 5 to 300 people, and professional firms whose clients require it

Fixed feescoped in 30 minutes
Details →

Mock Audit Package: SOC 2, HIPAA or CMMC

Organizations within 90 days of a SOC 2 audit, an OCR inquiry or a C3PAO assessment, and any leadership team that wants to know before it counts

Fixed feescoped in 30 minutes
Details →

What it asks for

In plain English, what SOC 2 expects you to have in place.

  • Scoped Trust Services CriteriaSecurity always; Availability, Confidentiality, Processing Integrity and Privacy when your customers require them.
  • Controls designed and describedA system description and a control list an auditor can test, mapped to the criteria.
  • Evidence that controls operateAccess reviews, change tickets, vendor reviews, incident records and monitoring output, collected as they happen.
  • Policies adopted, not draftedA policy set your team has read and follows, with acknowledgements on file.
  • Risk and vendor managementA risk register reviewed on a schedule and a vendor list with the evidence you asked them for.
  • A licensed auditorOnly a licensed CPA firm can issue the report. We prepare you and sit in the audit with you.

A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.

SOC 2 in more detail: Type 1 vs Type 2 · what it costs · choosing an auditor · every SOC 2 guide

Or start with the 3-minute test

Where it starts

Your one-stop shop for SOC 2 compliance

SOC 2 is the gateway to enterprise customers, and for a small team it is also the biggest operational and financial bottleneck of the year.

Selling to enterprises or the public sector without a SOC 2 report is close to impossible. The report shows buyers that your security practices are real, judged against the five Trust Services Criteria from the AICPA.

Most platforms hand you software and wish you luck. We do the whole thing with you, from "what is in scope?" to "here is your auditor's login".

Find your size: tick what you have promised customers

Your likely scope: Security only. That is where most first-time SOC 2 reports start, and it is the smallest audit.

The steps

Eight steps from "we need SOC 2" to a signed report

The whole SOC 2 journey, short version. We handle every step with you.

pick your pair

Choose SOC 2 Type 1 or Type 2

Type 1 is a snapshot: on one day, your controls were designed correctly. Type 2 is the long haul: an auditor checks they kept working for 3 to 12 months. You do not have to do Type 1 first.

Type 1 or Type 2, and how long under observation

Type 2: 6 months under observation. A solid middle ground that enterprise buyers are comfortable with.

SOC 2 Type 1 vs Type 2 at a glance
FeatureType 1Type 2
Timeline measuredA single dayA period, usually 3 to 12 months
What it provesControls are designed correctlyControls work over time
SpeedWeeksMonths, because of the observation period
CostLower upfrontHigher, with more testing
How buyers see itEarly trust, a stepping stoneThe report enterprise deals ask for

Which report fits your deadline

When each report can landType 1 reportweek 16Type 2, 3 monthsweek 25Type 2, 6 monthsweek 38your deadline

Type 1 makes it. Type 2 does not. Get the Type 1, and start your Type 2 period the day after.

Assumes about six weeks to get ready, a ten-week Type 1 audit, and a report roughly six weeks after a Type 2 period ends. Your gaps and your auditor's calendar will move these.

find your size

Work out what applies to you

SOC 2 is not a checklist of controls. Your scope depends on the systems you put forward, the data they process and what they touch. Two companies can both pass with very different policies.

With AccuSights: we scope it with you from the intake form and put it in writing, so you audit what matters and nothing extra.

check for holes

Run the gap analysis

What you have versus what the criteria expect. Tooling, configurations, policies, procedures: what is in place, what is half-baked and what needs baking from scratch.

How much do you want to do yourself

Software, and you drive. A platform automates the evidence. You still make every judgment call. Works if someone on the team has been through an audit.

With AccuSights: your engineer tells you how far each control needs to go, so you stop guessing what the auditor will ask for.

close the gaps

Close the gaps

Even well-run companies find big gaps the first time. Most are not in firewalls or configs. They are in policies, procedures and workflows nobody wrote down.

With AccuSights: remediation is in-house. We draft the policies and fix the configurations with you, so you never have to explain your setup to a second vendor.

run the long cycle

Stay continuously compliant

Going for Type 1? Skip ahead. For Type 2, your controls now have to run for 3 to 12 months without drifting. No cheeky employee switching off MFA, no snoozed alerts.

Control monitorIllustration
  • Laptops encryptedPassing
  • MFA on every accountPassing
  • Policies acknowledgedPassing
  • Access reviewed this quarterPassing

Does it pay for itself

-$1,740 a yearIt does not pay for itself on time alone. You would save about 156 hours, worth $13,260, against a $15,000 price. Break-even is 6.8 hours a week of manual work. It can still be worth it for a Type 2, where the real saving is exceptions you never get.

Be honest about the share. Vendors quote big time savings, and nobody has published an independent measurement. Half is a reasonable starting guess.

With AccuSights: we watch every control around the clock and catch the drift before your auditor does.

check for loose threads

Get an external penetration test

Does the AICPA require a pen test? No. Should you get one? Probably. Most CPA firms expect it, and fixing a critical finding before the auditor sees it proves your detect-and-respond loop works.

Pen test price by scope

Typical price by scope, in thousands of dollars

Penetration test price by scope$0k$15k$30k$45k$60kExternal network$4k to $15kSmall web app$4k to $12kAPI only$3.5k to $18kWeb app and API$10k to $25kCloud config review$6k to $30kWeb, API and cloud$12k to $25kSeveral products$25k to $60k+

Web app and API: $10,000 to $25,000. The usual SOC 2 scope for a SaaS product.

With AccuSights: light pen testing in-house, plus partners for a full external test with a report that goes straight into the audit.

hang it out for the auditor

Go through the external audit

The part you have had nightmares about is calmer than you think. What matters is picking the right CPA firm and knowing what they will ask for.

Ten questions to ask before you sign

With AccuSights: we help you get quotes from the right firms and arrange the audit. Your auditor logs into the auditor portal and finds every piece of evidence already in order.

wear, wash, repeat

Stay compliant and prepare for next year

A SOC 2 report covers a period, and buyers want a current one. That means access reviews, policy sign-offs, a yearly risk assessment and vendor reviews, all year, every year.

The renewal year, month by month

Jan: New period starts the day after the last one ended. Write a bridge letter if customers need one. Start the annual risk assessment.

These cadences are common practice. SOC 2 does not mandate them. Whatever your policies promise is what the auditor will test.

With AccuSights: evidence keeps collecting itself, so next year's audit is a renewal and not a rerun.

Why AccuSights

Why small teams pick AccuSights for SOC 2

Most compliance platforms assume you have a security team. We built this for the companies that do not.

Priced for a startup, not a Series D

One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.

The endpoint agent is built in

Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.

A human who has done this before

A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.

Wash once, wear everywhere

Controls are cross-mapped natively. The evidence you collect for SOC 2 carries over when the next buyer asks for something else.

SOC 2ISO 27001HIPAANIST CSF 2.0GDPR
A dashboard that stays red, beside The AccuSights planA dashboard that stays redMonth 4FindingOwner, statusMFA off on 3 admin accountsNobody, open 4 monthsSix laptops not encryptedNobody, open 4 monthsNo access review since 2024Nobody, open 4 monthsBackups never restore-testedNobody, open 4 monthsPolicies unsigned by staffNobody, open 4 monthsForty findings, a polite PDF, and good luck.The AccuSights planWeek 5FindingOwner, statusMFA off on 3 admin accountsEngineer: Fixed, week 1Six laptops not encryptedIT provider: Fixed, week 2No access review since 2024Office manager: Fixed, week 3Backups never restore-testedEngineer: Fixed, week 4Policies unsigned by staffOwner: In progress, week 5Red is fine on day one. Not on day ninety.
Illustration. Left: the same five findings, four months on, nobody assigned. Right: the same five with an owner and a date, closed one a week by your engineer. Your findings will be your own.

The platform

SOC 2 compliance software that does the busywork

Six things the AccuSights platform takes off your plate, shown with a sample company. ColdFeet Inc. is made up. The features are real.

Unified executive dashboard

Your whole security and compliance picture. One screen. No tab hopping.

ColdFeet Inc.Executive dashboard
118open items: 52 to collect, 40 to answer, 24 to review, 2 mandatory gaps to close
Security32%
Availability36%
Evidence accepted39%
Close mandatory gapsOwner: IT lead, due Friday2 open
A dashboard with 118 open items, 31 percent SOC 2 readiness and the next tasks to close. Sample data.

Streamlined assessments

No more wrestling with rulebooks. Answer simple questions, know exactly what is required, and see which evidence proves it.

ColdFeet Inc.Assess

AvailabilityMandatoryAnswered

Do backups run on schedule for every system in scope?

YesPartialNo

What is required

Scheduled backups for every in-scope system, with failures followed up.

Evidence that proves it

Backup job report, linkedBackup schedule

6 of 14 answered43%
One plain-English question answered, with what is required and the evidence that proves it. Sample data.

Automated evidence collection

Retire the screenshot scavenger hunt. AccuSights agents and integrations gather security data from your systems and link it to the right controls.

ColdFeet Inc.Evidence
Collected automatically today 3Screenshots you took 0
MFA policy and user exportMicrosoft Entra ID, access controlLinked
Disk encryption, 20 of 20 laptopsAccuSights endpoint agent, device securityLinked
Backup jobs, 15 of 15 workloadsMicrosoft Azure, backup and recoveryLinked
Evidence arriving from an identity provider, the AccuSights endpoint agent and a cloud account, each linked to its control. Sample data.

AI policy builder

Skip the blank page. Create or update policies with AI and AccuSights best-practice templates, then an AccuSights engineer reviews the details.

ColdFeet Inc.Policy builder

A few questions

Document owner: Information Security Lead

Where are identities managed? Microsoft Entra ID

Access Control PolicyReviewed
1. Purpose
2. Access model
3. Passwords and MFA
EngineerReviewed by your AccuSights engineer. One clause tightened.
A few questions, an access control policy drafted, and an engineer's review. Sample data.

Continuous control monitoring

Compliance does not clock out. Track connected controls around the clock and get alerts when something drifts. Add Aegis, our security agent, for visibility into threats, too.

Explore Protect

ColdFeet Inc.Continuous compliance
Live, last check 02:31All passing
MFA on admin accountsPassing
Laptops encryptedPassing
Cloud resources on baseline02:14 key vault purge protection switched off; 02:31 back on baseline, 38 of 38Passing
Backups completingPassing
Drift alert sent to the control owner at 02:14
AegisThreat detections alongside your controlsAdd-on
Four monitored controls, one drifting off baseline overnight, an alert to its owner, and the control back to passing. Sample data.

Auditor portal

Give your auditor a welcome break from email ping-pong. Share an organized audit pack with controls, evidence and status ready to review.

ColdFeet Inc.Auditor portalRead only
Logical and physical access29 of 29
Change management11 of 11
Backup and recovery9 of 9

Change management: evidence

Accepted Pull requests with approvals

Accepted Release checklist, last quarter

Accepted Change policy, approved

Shared with the auditor, read onlyPack shared
A read-only auditor portal with evidence organized by control family, shared with the auditor. Sample data.

What it costs

What SOC 2 costs, in plain numbers

Nobody likes hunting for prices, so here are the typical figures for a small company, with who published them and when.

$5,000 to $15,000Auditor's fee for a Type 1 at a boutique CPA firm, for a company under about 50 people with Security in scope.Source: soc2auditors.org, observed SOC 2 audit quotes, checked October 2026
$7,000 to $25,000Auditor's fee for a Type 2 at a boutique CPA firm; the directory's mid-2026 median was about $9,000.Source: soc2auditors.org, observed SOC 2 audit quotes, checked October 2026
$20,000 to $35,000Lean first-year total for a small SaaS company, all in: audit, pen test, tools and help.Source: our SOC 2 cost guide, sources listed there, October 2026
From $6,000 a yearAccuSights SOC 2 readiness for a small business: scoping, gap assessment, policies, the evidence vault and the auditor handoff, as a fixed fee.Source: AccuSights pricing page (2026)

Our part is a fixed fee: SOC 2 readiness from $6,000 a year for a small business. Tell us about your environment on the short intake form and you have your number in writing within 24 hours of sending it back.

Get my SOC 2 quote

Self-serve compliance software

  • You get a portal and drive it yourself.
  • Expert help is often a separate purchase or a partner referral.
  • Device checks usually need an MDM you set up first.
  • Pricing comes after a sales call.

AccuSights

  • A named engineer runs it with you.
  • Guidance and remediation are included, not referred out.
  • The endpoint agent ships with the platform.
  • A fixed fee, in writing, within 24 hours of the intake form.

Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing

Service sheet, free to keep and share

SOC 2 readiness without the scramble

What to decide first, what auditors ask for, and what to send customers in the meantime. Two pages, PDF, written for whoever runs the office.

By asking for the sheet you agree to the privacy policy. We may follow up once about it; reply stop and we will not write again.

Questions

SOC 2 questions we get every week

What is SOC 2?
SOC 2 is a report from an independent CPA firm, under AICPA standards, on how a service organization protects customer data. It is built on the Trust Services Criteria: security is required, and availability, processing integrity, confidentiality and privacy are optional. Buyers use it to judge vendors. It is not a law or a certificate. We get you ready and keep controls running.Source: AICPA and CIMA, SOC 2
What is the difference between Type I and Type II?
A Type I report gives the auditor's opinion on whether controls are suitably designed at a single date. A Type II report also tests whether they operated effectively over a period, commonly three to twelve months. Most enterprise buyers prefer Type II. Many startups start with Type I to unblock deals, then move to Type II.Source: AICPA and CIMA, SOC 2
Who can issue a SOC 2 report?
Only a licensed CPA firm can issue the report, because it is an attestation under AICPA standards. Readiness partners such as AccuSights help you design controls, collect evidence and fix gaps, but cannot sign the report. Keeping those roles separate protects your report's credibility with buyers. We coordinate with the CPA firm you choose.Source: AICPA and CIMA, SOC 2
How long does SOC 2 take?
A first Type 1 audit takes two to three months, because it tests your controls on a single date. A Type 2 report needs an observation period of 3 to 12 months, and the report follows four to eight weeks after that. Readiness work before either, such as policies, access controls and logging, takes weeks to months depending on where you start. We give you a dated plan after scoping.Source: Our guide: SOC 2 Type 1 vs Type 2
Is SOC 2 the same as ISO 27001?
No. SOC 2 is an attestation report by a CPA firm, common with US buyers. ISO/IEC 27001 is a certification of your information security management system by an accredited body, common internationally. They overlap a great deal, so one set of controls and evidence can support both. We map them together so you do the work once.Source: AICPA and CIMA, SOC 2
Do small companies need SOC 2?
Only if customers ask for it. No regulation requires SOC 2, but enterprise and regulated buyers often do before signing. If questionnaires keep stalling deals, a report may pay for itself; if not, a solid evidence pack may be enough for now. A 30-minute Risk Diagnosis with our engineer helps you decide.Source: AICPA and CIMA, SOC 2
Do I need a SOC 2 Type 1 before a Type 2?
No. You can go straight to a Type 2 audit if your controls are already running. A Type 1 is useful when you need a report quickly to close a deal, or when your controls are brand new and you cannot wait out an observation period. A common middle path is a Type 1 now with the Type 2 period starting the day after.Source: Our guide: do you need a SOC 2 Type 1?
How much does a SOC 2 audit cost for a small company?
At boutique and specialist CPA firms the auditor's fee is typically $5,000 to $15,000 for a Type 1 and $7,000 to $25,000 for a Type 2. A lean first year lands at $20,000 to $35,000 all in, with the pen test and tools. AccuSights readiness is a fixed fee from $6,000 a year for a small business, in writing within 24 hours of the intake form, and we do not mark up the auditor.Source: Our guide: SOC 2 cost, IT implementation and hidden costs
Is a penetration test mandatory for SOC 2?
The AICPA does not mandate one. A pen test appears as an example under CC4.1, not as a requirement. Most CPA firms still expect it, because vulnerability scans alone do not clearly satisfy some control requirements, and your largest customer's security team will ask sooner than the auditor does. Budget for one a year.Source: Our guide: does SOC 2 require penetration testing?
Is SOC 2 a certification?
Strictly, no. SOC 2 is an attestation: a licensed CPA firm examines your controls and issues a report with its opinion. People call it a certificate, and say "SOC 2 certified" all the time, but there is no certifying body and only the auditor can issue the report. We prepare you for the audit and do not issue it.Source: Our guide: SOC 2 Type 1 vs Type 2
Can I get SOC 2 ready without a GRC tool?
Yes, with spreadsheets, screenshots and a lot of patience. The guide carries a starter tracker you can copy. A GRC platform collects evidence automatically and watches for control drift, which matters most during a Type 2 observation period, when a missed quarterly review cannot be backdated.Source: Our guide: SOC 2 without a GRC tool
Do you certify SOC 2 compliance?
No. We do not certify, and the regulator, examiner or independent auditor for SOC 2 has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with SOC 2?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do SOC 2 separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.

Also in Security: NIST CSF 2.0 · ISO 27001 · CIS Controls · NIS2 · every framework by industry

Next step

Thirty minutes, an engineer, a written scope for SOC 2.

Book the demo and see how one control set carries SOC 2 and everything else you owe. Or leave your details and an engineer replies within one business day.

Get a fixed-fee quote

See how we use your information

3-min test