SOC 2 FAQ
Answers to the questions we hear most often about System and Organization Controls 2 (SOC 2): whether it is required, how the attestation works, and what the process costs in time and money.
Is SOC 2 mandatory?
No, a SOC 2 is not legally required of any organization. However, your customer may require you to obtain one in order to do business with you.
Is SOC 2 a certification or an attestation?
There’s no such thing as SOC 2 certification. It is more accurate to call the process of gaining compliance a SOC 2 attestation. This is because SOC 2 audits are conducted by licensed CPAs based on standards set by the AICPA, but there’s no certifying body or official certification. Auditors provide an objective report on your security posture that lacks a pass or fail outcome.
Who needs to comply with SOC 2?
SOC 2 compliance is not legally required for any organization. It’s completely voluntary for businesses to get and there are no fines or penalties for not having a SOC 2. This standard is commonly used by SaaS companies, organizations that provide business intelligence or analytics, and managed IT providers.
Can you fail a SOC 2 audit?
You can’t technically "fail" a SOC 2 audit, as there’s no pass or fail system. Instead, the auditor provides an objective report on your security posture. If your controls or their execution don’t meet the required criteria, the report may include a “qualified opinion,” signaling areas that need improvement.
What should we review in the draft report?
Your auditor sends a draft report before issuing the final version, and it deserves a section-by-section review. Section 1 is the auditor's opinion; read it in full and make sure you understand and agree with the language, because it is the headline result of the audit. Section 2 is the management assertion, standard language you cannot change but should still read so you know what your organization is asserting. Section 3 is the system description you provided; skim it to confirm nothing significant was altered from the copy you submitted. Section 4 lists each control alongside the auditor's test results; review both columns carefully to confirm your controls and the outcomes are documented accurately.
Exceptions should not surprise you at this stage. Auditors communicate them during fieldwork, so if none were raised along the way, the draft is most likely a clean report.
How much does a SOC 2 audit cost?
Taking into account lost productivity, build vs. buy decisions for new tools, and security training, we estimate the cost at $147,000 all-in.
How much will an Auditor charge for a SOC 2 Type 1 audit?
Expect the cost of an auditor for SOC 2 Type 1 to be in the $12k-$17k range.
But the cost of the auditor is just the beginning. You will need months of dedicated time from your existing staff or consultants. Once the audit is complete, you will have a set of remediation items, which may necessitate the purchase of additional tools and training as well.
Lost Productivity
First, assign someone to own the SOC 2 process from start to finish. Expect this to become a full-time focus for the duration of the project. This is a hidden SOC 2 cost that may not be obvious to account for. This responsibility is not something that can be delegated to your IT or security team, nor can it be handled by junior staff. The initiative needs to be led by someone who has sufficient familiarity with technical systems to be efficient with the team’s time. That person also needs the authority to direct work across teams, because remediation touches engineering, IT, HR, and legal.
Readiness Assessment
Next, you will need a readiness assessment. This assessment is designed to educate your team on the audit scope and conduct preliminary investigative and prep work, including identifying data stores, mapping workflow, and creating an inventory of technical systems. It’s also the right time to give some of your key teams, like legal and HR, a heads up that some of your company’s documentation and policies will need to be changed.
Legal
Review with your attorney all customer agreements, vendor and contractor agreements and employment agreements. These agreements will establish a foundation of responsibility assignment that allows you to make assertions in your policies regarding confidentiality, privacy and security. You may need to revisit these annually with each audit. Anticipate this will be an ongoing SOC 2 cost.
Build vs. Buy Decisions
Depending on your existing infrastructure and security posture, you may need to roll out several new tools as you ramp up your SOC 2 program. Tools that can collect asset inventory, generate tickets for capturing compliance tasks, as well as manage security and compliance reporting. You will also need tools for threat and intrusion detection, file integrity monitoring and vulnerability management. You’ll face many build versus buy decisions. If you have time, but not enough budget, you may choose a DIY approach. In that example, your Access Onboarding & Termination Policy might consist of open-source tools and custom scripts. If you need to move faster, you could buy a tool like Openlane to automate onboarding, termination and auditing.
Staff Training
Another important cost to consider is security training. You will want to start conducting annual security awareness training, either in-house or through a third party, if you don’t already. Someone will need to make sure the entire company attends the training and that all employees sign off on receiving it. Expect this to incur logistical costs and impact team productivity, which is a lesser-known SOC 2 cost.