SOC 2 Type 2: what the report covers, how long it takes and what it costs

SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls against the AICPA Trust Services Criteria and issues a report with its opinion. A Type 1 report covers design at a single date. A Type 2 covers design and operating effectiveness across a period, which is why buyers trust it more.

Security is the only required category. Availability, Confidentiality, Processing Integrity and Privacy are added when your customers need them. How the two report types compare is on SOC 2 Type 1 vs Type 2.

1. The auditor’s opinion. The one page a security reviewer reads first.
2. Management’s assertion. Your signed statement that the description is fair and the controls worked.
3. The system description. Your services, infrastructure, people, data and the boundaries of the audit, written by you.
4. The controls, the tests and the results. Each control, how the auditor tested it, and whether any exceptions were found. A Type 1 has no test results; this section is what makes a Type 2.
5. Other information, optional: your responses to exceptions, for example.

The report is restricted use. You share it with customers and prospects under NDA, not on your website.

The AICPA sets no mandatory minimum, though its guidance cautions that periods shorter than six months may be less useful to readers. In practice many auditors accept three months for a first report, six to twelve months is typical, and twelve months is the norm from the second year on.

The period starts on a date you agree with the auditor. Every control has to operate from that day, so start it only when the controls are already running. A miss in week two counts the same as a miss in month eleven.

Auditors use four methods, usually in combination: inquiry (asking the person who runs the control), observation (watching it happen), inspection (reading tickets, logs, settings and sign-offs) and reperformance (doing the control themselves and comparing the result).

For recurring controls they sample across the whole period. A daily control gets more samples than a quarterly one, and a quarterly access review is often checked every quarter. Samples come from populations you provide, such as the full list of new hires or production changes, so those lists have to be complete.

An exception is a sample where the control did not work: a leaver who kept access for three weeks, a change deployed without review. Exceptions are listed in section four. One or two with a clear explanation rarely change the opinion, and buyers read them with your response.

The opinion itself is one of four: unqualified (clean), qualified (clean except for specific issues), adverse (the controls did not meet the criteria) or a disclaimer (the auditor could not get enough evidence). Small companies that prepare well almost always get an unqualified opinion; a qualified one usually traces back to a period started too early.

The audit fee is only one line of the budget; the platform, the pen test and the fixes usually cost more. The full first-year bill is in SOC 2 cost and hidden costs.

A Type 2 covers a past period, so buyers want the next one to follow on without a gap. Between reports you issue a bridge letter: your own statement that nothing material changed since the period ended. From the second year most companies move to a rolling twelve-month period. See renewal and bridge letters.