SOC 2: cost, timeline and evidence.

What it costs, how long it takes, what the auditor actually asks for, and what happens when something goes wrong.

Every Trust Services Criterion also has its own page: what it asks a startup to show and the evidence that usually proves it. Read the criteria one by one.

What the 2027 SOC 2 Trust Services Criteria would changeA proposal out for comment, not criteria in force. It cuts the common criteria from 33 to 20, gives vendor management its own series, and adds points of focus for AI.9 min read

Does an agency need SOC 2? What client reviews ask forWhen you work inside client accounts, your access to them is the system a report describes.8 min read

SOC 2 for AI companies: what actually changesNo AI criteria exist. What moves is the carve-out, the vendor file and the questionnaire.9 min read

ISO 27001 to SOC 2: what carries overThe four questions a certificate holder actually has, answered in order, with the crosswalk printed in full on the page.9 min read

SOC 2 for API companies and developer toolsAn API changes the scope, the uptime question and where your change evidence comes from.8 min read

What a SOC 2 auditor actually chargesA SOC 2 has two costs and they go to two different parties. This is the half almost nobody prices in public.7 min read

The bridge letter, including the version nobody writesIt covers the months since your report period ended, it is signed by you, and every template we have read assumes the easy case.7 min read

SOC 2 certification cost (and why it is not a certification)Buyers ask for a certificate, and SOC 2 does not have one. Here is the price, and the document that actually arrives.5 min read

Is an employer of record a subservice organization?The provider employs the person. You grant the access. That split decides which controls stay yours and what their paperwork is actually good for.8 min read

What SOC 2 actually costsThe vendors who sell SOC 2 publish what an audit costs and leave their own price off their websites. Here is the whole invoice, line by line.9 min read

The SOC 2 Trust Services Criteria, explained one by oneEach criterion on one page: what it asks, what proves it, and whether it is in your scope.9 min read

Complementary user entity controls, and how to word yoursThe definition is one sentence. The wording is the part with consequences, because a vague CUEC transfers nothing and a precise one reads like a contract term.8 min read

Customer asking for SOC 2 report? Read the ask firstThe deal is held on a single line in a security review. Here is what exists on your deadline, and the note to send while the examination runs.7 min read

The SOC 2 evidence checklist, by cadenceThirty artifacts, grouped by how often you have to produce them rather than by control area, because the calendar is what actually breaks.9 min read

What happens when a SOC 2 audit finds exceptionsA SOC 2 has no pass mark, so there is nothing to fail. What founders mean by failing is an exception, and exceptions are normal, visible to buyers, and mechanical to clear.8 min read

SOC 2 for fintech: what a bank partner reviewsA bank partner has to review you, and the 2023 interagency guidance names SOC reports.8 min read

What a SOC 2 gap analysis findsFour different things get sold under three names. Here is what each one produces, who is allowed to run it, and which of them a buyer will actually accept.7 min read

How many controls are in SOC 2?None. SOC 2 defines criteria and leaves the controls to you. There are 61 criteria, and a Security scoped report is measured against 33 of them.6 min read

Your SOC 2 in progress, and what to tell customersA buyer wants a report you do not have yet. There is a truthful answer that keeps the deal moving, and there is the version that costs you the account later.8 min read

Is a cheap SOC 2 audit legitimate?A low price is a reason to check, not proof of a fake. What separates a real examination from a form report, and five checks that settle it on any vendor.8 min read

SOC 2 for legal tech companies selling to law firmsA law firm’s duty to protect client data becomes your vendor review. Here is what it asks.8 min read

SOC 2 log retention: how long to keep logsThe Trust Services Criteria set no retention period. The floor falls out of your own calendar, and several tool defaults sit well underneath it.8 min read

How long the SOC 2 observation period has to beThree months is the floor and six is common. Neither number comes from a rule. Both come from how many times your controls fire before anyone samples them.7 min read

The SOC 2 PBC list, request by requestEvery page about evidence requests defines the term and stops. This one prints the list, in the wording an auditor uses, with the reason each item comes back.9 min read

The SOC 2 policy list, and why the count keeps changingPublished lists disagree because the standard never sets a number. Here is what the criteria actually ask for, and the thirteen documents that answer them.7 min read

How ready are you for SOC 2?Five questions below, no account and no email box. The full assessment is free too, and it gives you a score and a written gap list rather than a brochure.7 min read

How long a SOC 2 report stays usefulIt never expires, because it is not a certificate. What ages is the window it describes, and buyers enforce that line themselves.7 min read

SOC 2 report example: a sample Type 1 package, section by sectionA watermarked sample Type 1 package for a fictional company, read one section at a time.8 min read

Switching SOC 2 audit firmsBetween periods it costs you a procurement cycle. Mid period it costs you months of coverage, because the new firm cannot report on time it never watched.7 min read

How long a SOC 2 actually takesEvery phase, the duration it actually takes, and the four things that reliably push your date out.7 min read

SOC 2 for a small team: what actually changesSegregation of duties, access reviews, screening, change approval and incident response all assume more people than you have. Here is what stands in.8 min read

How to verify a SOC 2 report you were sentThe document arrives as a PDF and somebody has to decide whether it counts. Here is the read order, and the six checks a template cannot survive.7 min read

Who can perform a SOC 2 auditThe rule is one sentence long. Everything else sold in this market is preparation, which is a different job from signing.7 min read

Get audit-ready without a compliance team.

The readiness assessment returns your readiness score, every gap category counted with exact numbers, and your first findings written out in full. Free. No payment and no card.

Take the free assessment