SOC 2 for Startups: The Complete Guide

The short version, for a 5-25 engineer startup:

• SOC 2 is not a certificate. It is an attestation report written by a licensed CPA firm about your controls, against the AICPA’s Trust Services Criteria. Nobody “passes” SOC 2; an auditor issues an opinion on it.
• Scope Security only for report one. The AICPA defines five criteria categories; per Secureframe, Security is mandatory and is also called the Common Criteria, and the other four are optional. Every category you add buys you auditor hours and controls you must then keep operating.
• Start when a customer asks, not before. SOC 2 is a sales unlock. Buying it with no enterprise pipeline is a five-figure answer to a question nobody has posed.
• The paperwork is the small half. Policies and training are a week with a platform. Encryption, SSO, least-privilege IAM, centralised logging, tested restores, and controlled deploys are the months.
• A compliance platform does not make you compliant. It reads your cloud and packages evidence. If a check is red, the fix is in AWS, GCP, or Azure — not in the dashboard.
• Two reports, one journey. Type I proves design on a date; Type II proves operation over a window. Per Vanta, the Type II observation window is a choice of 3, 6, 9, or 12 months, and the window is most of the timeline.
• Budget both currencies. Cash lands roughly in the $25,000-$45,000 band for a lean first year; the second currency is engineering weeks nobody invoices.

What is SOC 2, and who actually needs one?

SOC 2 is an independent examination, performed by a licensed CPA firm, of the controls a service organisation runs over its systems — reported against the AICPA’s Trust Services Criteria. It exists so your customers’ security teams can outsource their diligence: rather than auditing you themselves, they read an accountant’s opinion on whether your controls were suitably designed and, in a Type II, whether they operated. It is an attestation, not a certification, which is why “SOC 2 certified” is technically wrong and universally said anyway.

The people who need one are B2B companies whose customers push data into their systems and whose buyers have a vendor-risk process. In practice that means most B2B SaaS the moment it moves upmarket. If you sell to SMBs who sign with a credit card, nobody will ever ask.

Who does not need one yet

If no prospect has requested it, no questionnaire has blocked, and your pipeline is self-serve, you do not need SOC 2 this quarter. The framework has no legal force — it is a commercial artefact, and its value is exactly the revenue it unblocks. Where SOC 2 sits relative to ISO 27001, HIPAA, PCI DSS, and ISO 42001, and at which funding stage each becomes worth buying, is a separate sequencing question we work through in the startup compliance roadmap.

One more disambiguation before you spend anything. Buyers say “SOC report” loosely, and SOC 1 (financial reporting controls) and SOC 3 (a public summary of a SOC 2) are different animals. If a security team is asking, they mean SOC 2 — the decoder ring is in SOC 1 vs SOC 2 vs SOC 3.

What is actually inside a SOC 2 report, and how do buyers read it?

A SOC 2 report is a long PDF, shared under NDA, with a predictable structure. Per A-LIGN’s breakdown, it contains the independent service auditor’s report, management’s assertion, a system description, the trust services criteria mapped to your controls, and — in a Type II only — the tests of controls and their results. Buyers do not read it front to back. They read the opinion, then they read the exceptions.

Section	What it contains	What a buyer does with it
Independent service auditor’s report	The opinion — what was examined, which criteria were in scope, and the conclusion	Read first. This is the verdict
Management’s assertion	Your leadership’s statement that the description is accurate	Skimmed
System description	Infrastructure, software, people, processes, data flows, sub-service organisations	Checked against what you told them in the sales cycle
Criteria and controls	Your control language mapped to the criteria	Scanned for the controls their questionnaire cares about
Tests of controls and results	Type II only — how the auditor tested, and what they found	Read closely. Exceptions live here

What an opinion actually says

Per Secureframe, auditors classify the outcome four ways: unqualified (clean), qualified (passed, with areas needing attention), adverse (failed), and a disclaimer of opinion (not enough information to conclude). Almost every startup report you will ever see is unqualified or qualified.

Exceptions are normal — hiding them is not

An exception is a deviation the auditor found: a control that did not operate as described for some part of the period. A quarterly access review that happened three times in four quarters. A restore test with no ticket behind it. Two deploys that bypassed review during an incident.

Exceptions do not automatically sink a deal. What sinks deals is an exception with no management response next to it, or a founder visibly surprised by one on a call. Know every exception in your own report, have a one-line remediation for each, and lead with them — most buyers have read worse. Publishing your security posture on a page like ours at /security/ also takes pressure off the report, because half the questionnaire is answered before it is sent.

Which Trust Services Criteria should you scope in?

The AICPA’s Trust Services Criteria comprise five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Per Secureframe, only Security is mandatory — it is also called the Common Criteria because much of it is shared across the others — and the remaining four are optional. For a first report, scope Security only unless a named customer contract requires more.

Criterion	What it covers	Scope it when
Security (Common Criteria)	Protection against unauthorised access, disclosure, and damage	Always — it is mandatory
Availability	The system is available for operation and use as committed	You sell an uptime SLA and a buyer has asked
Confidentiality	Information designated confidential is protected	You handle customer secrets, source code, or contract-restricted data
Processing Integrity	Processing is complete, valid, accurate, timely, authorised	You process transactions, payroll, or financial calculations
Privacy	Personal information is handled per your notice and criteria	Rare for early SaaS; usually GDPR-style obligations elsewhere

Adding Availability is the most common second choice and it is a reasonable one, because a startup that already runs backups and monitoring is not far from A1. But understand what you are signing up for: every category you scope becomes controls you must operate for the whole Type II window, and every one of them is testable. Scope is the cheapest decision to get right and the most expensive to reverse.

The criteria are written in auditor language, and the translation to actual cloud configuration is where the work is. Our criterion-by-criterion reference — SOC 2 controls mapped to infrastructure — walks CC6, CC7, CC8, and A1 and gives the concrete AWS, GCP, and Azure change that satisfies each one. If your product is AI, note that the criteria contain no AI-specific control; what changes is scope and evidence, which we cover in SOC 2 for AI startups.

What does the journey look like, from “a deal asked” to “report in hand”?

Six stages, and only one of them is the audit. A prospect asks; you scope and gap-assess; you remediate infrastructure; you take a Type I to unblock the deal; you run an observation window; you get a Type II and then renew it annually. The stages that eat calendar are remediation and the window — everything else is weeks.

Stage 1 — the trigger. A security questionnaire lands, or procurement says “send your SOC 2.” Ask the prospect exactly what they need: Type I or Type II, and which criteria. Their answer sets your scope and can save you a category.

Stage 2 — scope and gap assessment. Decide criteria, decide which systems and environments are in scope, and measure your cloud against the controls. This is a technical exercise against real accounts, not a policy template review. Our SOC 2 infrastructure checklist is the ordered task list to run it yourself, and the free CIS Benchmarks give you an auditor-recognised hardening baseline at zero cost if you have no security baseline at all.

Stage 3 — remediation. The longest engineering stretch. Identity centralisation, encryption gaps, log aggregation and retention, backup and restore testing, branch protection and pipeline deploys. Policies, training, and vendor reviews run in parallel here — sequencing them after remediation adds a month for nothing.

Stage 4 — Type I. A point-in-time opinion. Per Vanta’s published timeline, the audit itself is 2-5 weeks, then 2-6 weeks for report creation and delivery; the audit firm Johanson LLP quotes 4-6 weeks to complete a Type I attestation. Fieldwork ending is not the report arriving — count backwards from the PDF, not the fieldwork.

Stage 5 — the observation window. Per Vanta, you choose 3, 6, 9, or 12 months, with three the minimum; Johanson describes the same pattern from the auditor’s side. Crucially, the window can open the same month as your Type I audit, so the two run in parallel rather than in sequence. The trade-off between the two reports is in Type I vs Type II.

Stage 6 — Type II, then annual renewal. Fieldwork samples evidence across the whole window, then the report follows. Per Secureframe, SOC 2 reports have no formal expiration date, but most customers only accept one issued within the last 12 months — which makes this an annual cycle, not a project.

The week-by-week version of all of this, including what actually causes delays, is in how long SOC 2 really takes.

Who does what — you, the auditor, the platform, and an engineer?

Four parties, and the failure mode is assuming one of them covers another’s job. The auditor tests; they do not advise on how to fix (independence rules limit how much they can help). The platform observes; it does not build. You own scope, policy, and the commercial decisions. An engineer makes the controls true.

Party	Owns	Does not own
You (founder / CTO)	Scope, auditor selection, window length, policies, training, questionnaire answers	The technical remediation, unless you are also the engineer
Compliance platform (Vanta, Drata, Secureframe)	Continuous config reads, evidence packaging, policy and training templates, audit-room workflow	Fixing anything. A red check is a work ticket, not a bug in the platform
Infrastructure engineer	SSO and MFA, least-privilege IAM, encryption, centralised logging, backups and tested restores, change management in CI	Writing the opinion, or deciding scope
CPA auditor	Sampling evidence, testing controls, writing the opinion and noting exceptions	Remediation advice, or guaranteeing an outcome

The platform’s value is real and worth paying for — Vanta advertises 400+ integrations and hourly automated tests, and its AWS integration alone monitors 40+ resource types with 100+ pre-built tests per Vanta’s own integration docs. But the automation reads state; it cannot create it. What the platforms do and do not collect for you is the subject of Vanta and Drata evidence automation.

Which decisions cost the most if you get them wrong?

Four, in descending order of damage: scope, window length, auditor choice, and tooling. Each is made in an afternoon and lived with for a year.

Scope. Over-scoping is the most common expensive mistake. Adding Availability, Confidentiality, Processing Integrity, or Privacy to a first report adds auditor hours, adds controls, and adds things that can generate exceptions for twelve months. Add a category when a contract names it, not because it sounds more impressive.

Window length. Take the shortest legitimate window for report one — three months — and lengthen later. A twelve-month first window means twelve months of exposure to a skipped access review before you have any report at all. Long windows look stronger, and they are, but strength you cannot ship is not worth much when a deal is waiting.

Auditor choice. The spread here is enormous for a report that says the same thing. Per Vendr’s Drata buyer guide, third-party auditor fees for SOC 2 Type II run $8,000-$25,000; Compass IT Compliance publishes $20,000-$50,000 for a Type I and $30,000-$100,000 or more for a Type II at traditional firms. Get three quotes, and ask each firm how many companies your size they audit per year. Also ask about scheduling: firms book out, and a slot you did not reserve becomes dead calendar between “ready” and “fieldwork”.

Tooling. Buy a platform — evidence collection by hand is a quarterly screenshot marathon, and per Secureframe a fully manual path stretches to 1 to 2+ years. But negotiate it. Per Vendr, Vanta buyers save 29.83% on average, with 15-30% off initial quotes for multi-year commitments; Drata deals average 23% savings. Vendr’s medians: Vanta $20,000/year across 373 purchases (range $7,500-$57,221), Drata $25,000/year across 233 purchases (range $9,494-$67,350), with 1-50 employee companies landing at $12,000-$28,000/year on either.

If your buyers are European rather than American, there is a fifth decision above all of these — whether SOC 2 is even the right framework. The AICPA’s own mapping puts the control overlap with ISO 27001 at roughly 80%, so the sequencing matters more than the choice; see ISO 27001 vs SOC 2.

What do auditors actually test, versus what teams fear they test?

Auditors test the controls you wrote, using evidence sampled from the period. They do not run a secret checklist, they do not scan your code, and they do not have an opinion about your architecture unless your own control language invited one. The fear is a surprise inspection; the reality is a request list and a sampling exercise.

What that means in practice:

• They sample, they do not exhaust. “Show me the access review for Q2” and “show me three deploys from March and their approvals.” Population completeness matters more than perfection — an inventory missing systems is worse than an inventory with a flaw.
• Your control language becomes the standard. Write “we review access quarterly” and a missed quarter is an exception. Write it conservatively and satisfy buyers separately in the questionnaire. This is the trap AI startups fall into when they promise eval coverage in a control they only meant as marketing.
• Evidence beats intention. A monitoring stack that never pages a human fails the spirit of the operations criteria even when the dashboards are beautiful. Nightly snapshots satisfy the backup criterion; only a restore you actually performed satisfies the recovery-testing one.
• Vendors are in scope, including new ones. AI coding assistants land in vendor management like any other subprocessor that receives your source code — what auditors ask, and the evidence to have ready, is in AI coding assistants and SOC 2.

What they generally do not do: audit your cloud provider’s data centres (you inherit those controls from AWS, GCP, or Azure’s own reports), demand a specific tool, or require a penetration test by name — though a pen test is the standard way teams satisfy risk-assessment expectations, and buyers ask for the report regardless.

What does SOC 2 cost, and how long does it take?

Cash for a lean first year lands roughly in the $25,000-$45,000 band — platform, a startup-focused auditor, one penetration test — and rises fast if you buy a traditional readiness engagement and a large-firm audit. Time to a Type I is a quarter-ish; time to a Type II is dominated entirely by the window you chose.

Item	Published range	Source
Compliance platform, 1-50 employees	$12,000-$28,000/yr	Vendr’s Vanta and Drata buyer guides
Platform implementation services	$5,000-$20,000 one-time	Vendr (Drata); ~60% of first-time buyers take some
Auditor fee, Type II (startup-focused)	$8,000-$25,000	Vendr’s Drata buyer guide
Auditor fee, traditional firm	$20,000-$50,000 (Type I) / $30,000-$100,000+ (Type II)	Compass IT Compliance
Readiness assessment bought as a service	$15,000-$25,000	Compass IT Compliance
Type I, end to end	2-4 months (Secureframe); 5 weeks-2 months (Vanta)	Secureframe, Vanta
Type II, end to end	5.5 months to 18+ months	Vanta
Observation window	3, 6, 9, or 12 months	Vanta

The line nobody quotes is engineering time. Built In puts average US DevOps engineer total compensation at $150,355 — about $72/hour across a 2,080-hour year, so four focused weeks is roughly $11,600 before counting the roadmap that did not ship. The full line-by-line breakdown, including pen testing and trust-centre add-ons, is in what a SOC 2 audit costs.

Disclosure: ByteDel sells a fixed-price $6,900 SOC 2-Ready Infrastructure package covering exactly the remediation stage — 3-4 weeks, delivered as Terraform in your repos on AWS, GCP, or Azure. That is one option among several. Doing it in-house is entirely reasonable if you have platform capacity; a vendor implementation package is reasonable if you would rather buy it from the same company as the platform. Details are on /soc-2-infrastructure/ and /pricing/.

How do you keep SOC 2 alive year over year?

By assigning an owner. Type II failures are almost never design failures — the controls existed in month one and quietly stopped. The quarterly access review that happened once. Log retention shortened to trim a bill. The restore test nobody re-ran. Amber checks in the platform with no name attached.

The maintenance load for a small team is modest but non-negotiable:

• Quarterly: access reviews recorded, vendor reviews refreshed, a restore actually performed and ticketed.
• Continuously: platform checks kept green, with drift caught in CI rather than at fieldwork. Infrastructure defined as code is what makes this cheap — a hand-clicked unencrypted database is a failed test in month seven of your window.
• Annually: renew the audit, refresh policies, re-run the penetration test, and re-scope if your product changed materially.

Year two is dramatically cheaper than year one if year one was done properly — a renewal, a re-audit, and a pen test, with a fraction of the engineering. It is expensive again if the first pass was cosmetic, because you will rebuild the same controls under time pressure with a window already running.

What are the honest failure modes?

Three, and they are all upstream of the audit.

Buying the platform and assuming it makes you compliant. This is the most expensive misunderstanding in the category. The platform is a conveyor belt for evidence; it does not manufacture the evidence. A dashboard full of red checks after a $20,000 purchase is the normal state of month one, not a defect.

Treating SOC 2 as paperwork when the work is infrastructure. Policies are a week. Encryption migrations, SSO rollouts, log pipelines with real retention, IAM that reflects least privilege, and a restore you have genuinely tested are the months. Teams that budget for the paperwork and not the plumbing are the teams whose window opens three months late.

Starting before a customer asked. SOC 2 has no regulatory force. Beginning it speculatively converts a sales tool into a tax — real cash, real engineering weeks, and an annual obligation, for a report that may sit unread. The counter-argument is worth stating fairly: good hygiene early makes the eventual audit cheap, which is a strong reason to harden your cloud now and a weak reason to engage an auditor now.

A fourth, quieter one: writing ambitious control language to impress a buyer. Every promise in your control set is a testable claim for the length of the window. Be generous in questionnaires and conservative in controls.

Where should you start this week?

If a deal is blocked, start with a technical gap assessment against your actual cloud accounts rather than a policy template — remediation sits on the critical path, and you cannot estimate it until you have measured it. Ask the prospect which report type and which criteria they need, and book an auditor slot before you finish remediating, not after.

If no deal is blocked, do the hygiene and skip the audit: SSO and MFA everywhere, no shared credentials, encryption on by default, logs centralised with retention, backups you have restored. That work is valuable whether or not a report ever follows, and it turns a future audit into a formality.

Our infrastructure health check maps which controls are already true in your cloud before you spend anything, and if you want the remediation scoped and done at a fixed price, get in touch.

This is engineering guidance, not legal or audit advice. Your auditor’s scoping decisions — criteria, systems, window, and what evidence satisfies which criterion — govern what your report actually requires.