What SOC 2 consulting services cover
"Consultant" covers three kinds of provider, and they aren't interchangeable.
- A compliance consultancy knows the criteria and the auditors. It scopes, runs the gap assessment, writes policies and prepares you for fieldwork.
- A vCISO is a part-time security leader. Good for judgment calls and for answering customer security questions, priced by the hour or on retainer.
- An MSP runs your IT day to day. It can roll out device management, single sign-on and backups. It may or may not know what an auditor will ask for.
What all three sell is experience. They've seen what auditors accept, so you don't over-build a control or under-build one.
What a GRC tool covers
A GRC or compliance automation platform connects to your cloud, identity provider, code host and HR system. It pulls evidence on a schedule, runs tests against it, and flags a control the moment it stops passing. It also gives you policy templates, a task list and a workspace your auditor can log into.
The value shows most in a Type 2 period, when you need proof that a control worked on every day of six months and not only on the day someone took a screenshot.
Who does which SOC 2 job?
| Job | Consultant or MSP | GRC software |
|---|---|---|
| Decide scope and criteria | Yes | No, you decide |
| Gap assessment | Yes, with judgment | Yes, for what it can connect to |
| Policies | Written for you | Templates you adapt |
| Fix configurations | MSPs yes, others advise | Rarely |
| Collect evidence | By hand | Automatically |
| Watch for drift | Periodic check-ins | Continuously |
| Deal with the auditor | Yes | A shared workspace |
| Answer "is this enough?" | Yes | No |
How much of this do you want to do yourself?
How much do you want to do yourself
Software, and you drive. A platform automates the evidence. You still make every judgment call. Works if someone on the team has been through an audit.
How much does each route cost?
- Consultant-led readiness: published fixed fees run about $5,000 to $25,000 for the assessment. Fixing the gaps is extra, and one advisory firm prices that at $2,000 to $10,000 if your practices are already strong, and $30,000 to $75,000 or more if they aren't.
- vCISO: typically $200 to $400 or more an hour, or $3,000 to $20,000 a month.
- GRC software: contract data from Vendr puts companies under 50 staff at about $12,000 to $28,000 a year for the big platforms. The lowest contracts Vendr records are around $7,500.
- Both: add them together. That stacked total is what a managed service should be compared against.
None of these include the auditor's fee. For the whole budget, see what SOC 2 costs.
Do you need a consultant if you already have a platform?
If someone on your team has run a SOC 2 before, probably not. If nobody has, expect questions the platform won't answer. Does a five-person company need a formal change advisory process? Is a contractor's own laptop in scope? What counts as a "timely" removal of access?
The criteria don't answer these and neither do the tools. An experienced person does. Several platforms sell that person as an add-on or refer you to a partner.
A rule about who can't do what
Whoever designs and implements your controls can't also audit them. A CPA firm may run a readiness assessment and point out gaps, but it may not write your policies or configure your systems and then give an opinion on its own work. Only a licensed CPA firm can perform the examination, so the company that sells you the automation tool can't. The AICPA's 2021 FAQ on SOC 2 software tools makes the same point.
So your consultant, MSP or platform sits on one side, and an independent CPA firm sits on the other. Be wary of anyone who blurs that line.
With AccuSights: you get the platform and a named engineer who has done this before, plus in-house remediation. The audit itself goes to an independent CPA firm, and we help you choose one.