SOC 2 compliance has become table stakes for B2B SaaS. Enterprise procurement teams ask for a SOC 2 report before the first meaningful contract. Mid-market buyers ask for it before the renewal. The question for most growing SaaS companies isn't whether to get SOC 2 — it's when, and how painfully. This guide covers what SOC 2 actually requires, what auditors look for, and how to prepare without derailing your roadmap.
What SOC 2 Actually Is
SOC 2 (Service Organization Control 2) is an auditing framework developed by the AICPA. It's not a certification in the ISO sense — it's an attestation by a licensed CPA firm that your company's controls meet one or more of the Trust Services Criteria, based on evidence collected during the audit period.
The report is produced by your auditor and shared (typically under NDA) with your customers. Enterprise buyers want the report because it gives them auditable assurance about how you handle their data.
Type I vs Type II
SOC 2 Type I describes the design of your controls at a point in time. It's faster and cheaper and answers the question "do you have the right controls documented?" SOC 2 Type II describes the operating effectiveness of those controls over a period (typically 3-12 months). Type II is what enterprise buyers actually want.
The common path: do a Type I first to establish the baseline, then operate controls for 3-6 months and get a Type II. Many companies skip directly to Type II with a shorter (3-month) observation window to move faster.
The Five Trust Services Criteria
SOC 2 reports cover one or more of five categories:
- Security (required): Protection against unauthorized access, including logical and physical. Every SOC 2 report covers this.
- Availability (optional): System is available for operation and use as committed.
- Processing Integrity (optional): System processing is complete, valid, accurate, timely, and authorized.
- Confidentiality (optional): Information designated as confidential is protected.
- Privacy (optional): Personal information is collected, used, retained, and disclosed in accordance with your commitments.
Most SaaS companies start with Security only and add Availability and Confidentiality as needed.
What Auditors Actually Test
The framework defines criteria at a high level. The auditor tests specific controls you implement to meet those criteria. The categories of controls that appear in nearly every SOC 2 audit:
Access Management
- Onboarding and offboarding workflows with documented approval.
- Quarterly (or more frequent) user access reviews.
- MFA on all production and admin systems.
- Least-privilege IAM policies, documented and reviewed.
Change Management
- Code review on every production change (PR approvals).
- CI pipeline that runs tests before merge.
- Audit trail of deployments tied to specific commits and approvers.
Vulnerability Management
- Regular vulnerability scans (weekly or daily) with documented remediation SLAs.
- Penetration testing annually or after major releases.
- Patching cadence for OS, dependencies, and third-party software.
Monitoring and Incident Response
- Logging and alerting on production systems with documented runbooks.
- Incident response plan with defined severity levels and communication templates.
- Post-incident review process with documented findings.
Vendor Management
- Inventory of all third-party services with access to customer data.
- Reviewed security posture (SOC 2 reports, DPAs) for critical vendors.
- Annual reassessment of vendor relationships.
Readiness Timeline
Most SaaS companies with reasonable engineering hygiene can reach SOC 2 Type I readiness in 3-6 months. Type II adds the observation period on top. The expensive parts are policy writing, gap remediation, and the auditor's fees — not the audit itself.
Months 0-2: Gap Assessment and Policy Work
Pick your auditor early — they shape the process. Use a compliance automation platform (Vanta, Drata, Secureframe, Sprinto) to inventory gaps and template the ~25 policies you'll need.
Months 2-4: Remediation
Fix the gaps. This is the engineering-heavy phase: turning on MFA everywhere, standing up quarterly access reviews, implementing CI checks, documenting runbooks, and so on.
Months 4-6: Operate and Observe
Run the controls. Collect evidence that they're actually working — screenshots, ticket trails, access review completions. For Type II, this is the observation period the auditor will sample from.
Months 6-9: Audit Fieldwork and Report
The auditor requests evidence samples and performs testing. Expect 40-80 hours of engineering time responding to requests over a 4-6 week window. The final report arrives 2-4 weeks after fieldwork ends.
Cost Expectations
All-in cost for a first SOC 2 Type II ranges from $30K-$80K depending on company size and scope:
- Compliance automation platform: $10-25K/year.
- Auditor fees: $15-40K for the first year.
- Internal engineering time: 100-300 hours across the prep and audit windows.
- Tools (logging, MDM, vulnerability scanning): $5-20K/year depending on what's already in place.
Common Pitfalls
- Starting too late. Prospects ask for SOC 2 before you have it. Start 6-12 months before you expect the first serious enterprise conversations.
- Policies disconnected from practice. Auditors cross-reference your written policies against what you actually do. Templated policies that don't reflect reality will get flagged.
- Skipping the vendor inventory. Forgetting that you share data with five tools you haven't vetted creates a last-minute scramble.
- No control owner. Every control needs a named owner responsible for operating and evidencing it. Generic "IT" ownership fails.
Frequently Asked Questions
How long does SOC 2 compliance take?
Type I can be achieved in 3-4 months from a clean start. Type II adds a 3-12 month observation window. Most SaaS companies aim for Type II with a 6-month observation period, totaling 9-12 months from start to final report.
Do I need SOC 2 or ISO 27001?
SOC 2 is preferred by most US buyers. ISO 27001 is preferred by European and Asia-Pacific buyers. Many SaaS companies pursue both — the underlying controls overlap significantly. If you have to pick one first, follow your target customer base.
Can a small team reach SOC 2?
Yes. Teams as small as 5-10 people routinely achieve SOC 2 Type II using compliance automation platforms. The scope of your SaaS matters more than your headcount.
Open Door Digital helps SaaS teams prepare for SOC 2 and other compliance audits. Talk to our team about your compliance roadmap.
Related reading: API Security Best Practices and Data Privacy Compliance.