SOC 2 Guide

What Is SOC 2? A Plain-English Guide From the Auditor's Chair

Yuanlun Yin, CPA · Texas & California · Y Assurance PLLC · Updated June 3, 2026
SOC 2 is an independent audit report, signed by a licensed CPA firm, attesting that your security controls meet the AICPA's Trust Services Criteria. It's an opinion backed by tested evidence under the SSAE 18 / AT-C 205 attestation standard, not a certification, a badge, or a checkbox you complete in a platform.

What SOC 2 actually is (and what it's not)

SOC 2 stands for System and Organization Controls 2. It's a report a licensed CPA firm produces after examining your controls against the AICPA's Trust Services Criteria. The thing you walk away with is the auditor's opinion, written down, with the testing behind it.

People call it a certification. It isn't one. There's no certificate, no certifying body, no SOC 2 logo you earn. ISO 27001 is a certification, granted by an accredited body. SOC 2 is an attestation, governed by SSAE 18 and the attestation standard AT-C 205, and only a CPA firm can sign it. That distinction matters more than it sounds. A certification says "a body checked a box." An attestation says "a CPA put their license behind an opinion about your specific system."

It's also not a one-click badge. If a tool tells you it can make you "SOC 2 compliant" by itself, read that carefully. A platform can help you organize evidence. It cannot form an opinion on your controls. That's the line the independence rules draw, and it's the whole reason the auditor and the platform are two different parties.

The Trust Services Criteria are organized into five categories: Security (the one every SOC 2 includes), Availability, Processing Integrity, Confidentiality, and Privacy. You pick the categories that fit what you actually do. A team that doesn't process customer transactions has no business scoping in Processing Integrity.

One more thing buyers miss: the report carries an opinion type. Unqualified means clean. Qualified means the auditor found something real and said so. Adverse and disclaimer are rare and bad. A clean opinion with thin testing behind it is worth less than a qualified one with honest work. The opinion is the headline; the evidence is the story.

Type I vs. Type II in plain terms

A Type I report is a snapshot. It tests whether your controls are *designed* properly as of a single date. Did you build the right controls? Are they sound on paper and in place right now?

A Type II report is a movie. It tests whether those controls actually *operated* over a window of time, usually 3 to 12 months. Not "is the lock installed" but "was the door actually locked, every day, for the period we observed."

Type IType II
QuestionAre controls designed right, today?Did controls operate over time?
Observation periodPoint in time3–12 months
Evidence weightLighterHeavier — sampled across the period
What buyers trust moreLessMore

There's no AICPA rule that you must do Type I before Type II. Many startups start with Type I to put something credible in front of a prospect quickly, then move to Type II for the period coverage enterprise buyers really want. Some skip straight to Type II.

What it costs

Honest ranges, not a number I'll invent for you. Across the industry, a Type I audit fee typically runs $5,000–$20,000, and a Type II $20,000–$50,000+, with Type II costing 30–50% more than Type I for the same scope (Secureframe). All-in — readiness, tools, internal time, the audit itself — most small-to-midsize companies land in the $30,000–$50,000 range for their first report (Secureframe).

Two things drive that number: scope (how many systems, how many TSC categories) and how much cleanup you need before testing starts. For your actual figure, use the pricing calculator on chiarohq.com or book a call. Anyone quoting a flat price before they've seen your stack is guessing.

How long it takes

Type I is faster — weeks once your controls are in place. A first-time Type II usually takes 6–15 months end to end, because the observation period is the long pole (Drata). You can't compress a six-month window into a week. What you *can* compress is the coordination around it, which in traditional audits eats far more calendar time than the testing does.

Who actually needs it

Almost nobody wakes up wanting a SOC 2. You get one because an enterprise prospect put it in front of you and said "no report, no deal." That's the trigger. In one 2026 benchmark, 73% of organizations regularly have to share a third-party audit report like SOC 2, and 61% say achieving compliance is required to win or renew contracts (Secureframe). If you sell B2B SaaS and you're moving upmarket, it's coming.

How to get a real one, not a stamp

The market is full of clean reports that didn't test much. Post-Delve, buyers know it. Here's how to tell the difference, by question:

Start with whether your auditor is a licensed CPA firm. Only a CPA firm can issue this report — that's not marketing, it's the rule. Everything else flows from there.

“A clean opinion with thin testing behind it is worth less than a qualified one with honest work — the opinion is the headline, but the evidence is the story.”

Frequently asked questions

Is SOC 2 a certification?
No. SOC 2 is an attestation report with an auditor's opinion, not a certification. There's no certificate and no certifying body — only a licensed CPA firm can issue one, under the AICPA's SSAE 18 / AT-C 205 standard. ISO 27001 is a certification; SOC 2 is a professional opinion backed by tested evidence.
Should I get SOC 2 Type I or Type II first?
There's no AICPA rule requiring Type I before Type II. Type I is a point-in-time snapshot of control design and is faster, so it's a common first step to satisfy a prospect quickly. Type II tests whether controls operated over 3–12 months and is what most enterprise buyers ultimately want. Some teams skip straight to Type II.
How much does a SOC 2 audit cost?
Industry audit fees typically run $5,000–$20,000 for Type I and $20,000–$50,000+ for Type II, with Type II costing 30–50% more for the same scope. All-in — readiness, tools, and internal time included — most small-to-midsize companies land around $30,000–$50,000 for a first report. Use the pricing calculator on chiarohq.com for your specific number.
How long does SOC 2 take?
Type I can be done in weeks once your controls are in place. A first-time Type II usually takes 6–15 months end to end, because the observation period (3–12 months) is the long pole. The testing itself is quick; the calendar time mostly comes from the observation window and coordination.
Do I need a compliance platform to get SOC 2?
No. A platform like Vanta or Drata helps you organize evidence, but it legally cannot sign your report — only a licensed CPA firm can form the opinion. The two are complementary, not the same thing. You can get a SOC 2 with a platform, with spreadsheets, or directly through an audit firm; the audit and the opinion are what's required.

Keep reading

Can a solo founder pass SOC 2?
How a one-person company passes, and how controls get right-sized.
What is a stamp audit?
How box-checking audits happen, and how to spot one.
What is vibe compliance?
Compliance that looks finished on paper but was never tested.
Is your auditor a real CPA?
Two steps to confirm your SOC 2 auditor is a licensed CPA.
What does a first-time audit find?
The gaps a first-time SOC 2 turns up almost every time.

Want a SOC 2 that actually holds up?

Get a fixed price in two minutes, or talk to the CPA who would run your engagement.

See pricing →Book a call →

Sources

  1. SOC 2 Type I audit fees typically run $5,000–$20,000, Type II $20,000–$50,000+, Type II costs 30–50% more than Type I, and all-in cost for small-to-midsize companies is ~$30,000–$50,000
  2. A first-time SOC 2 Type II report typically takes 6–15 months end to end; Type II observation period is 3–12 months; there is no AICPA requirement to do Type I before Type II
  3. SOC 2 is an attestation examination conducted under SSAE 18 / AT-C 205, based on the AICPA Trust Services Criteria, and only a licensed CPA firm can issue a SOC 2 report
  4. SOC 2 is technically an attestation report, not a certification — there is no certificate, only an independent CPA firm's opinion letter; the five Trust Services Categories are Security, Availability, Processing Integrity, Confidentiality, and Privacy
  5. SOC 2 opinion types are unqualified (clean), qualified (significant but not pervasive issues), adverse (pervasive control failures), and disclaimer (insufficient evidence to opine)
  6. In a 2026 benchmark, 73% of organizations regularly share a third-party audit report like SOC 2, and 61% say achieving compliance is required to win or renew contracts