SOC 2 certification cost (and why it is not a certification)

The vocabulary is wrong and everyone uses it anyway. Buyers ask for a certificate. Founders search for the price of one. The word is in the procurement email and in the security questionnaire, and correcting it in public wins you nothing. Knowing what you bought still decides what you send when a customer asks, and how long that document is worth anything to them.

There is no SOC 2 certificate

ISO 27001 is a certification. An accredited body audits you, issues a certificate, and that certificate carries a number and an expiry date. SOC 2 works differently. The AICPA writes the standards, and a licensed CPA firm performs an examination and reports its opinion on whether your controls meet the criteria you scoped.² No body certifies anyone. Nothing gets stamped.

The deliverable is a report, tens of pages long, carrying the examining firm’s name and its opinion in the first section. There is no wall plaque version, and no public register a customer can look you up in.

What to send when a buyer asks for your certificate

Send the report. Do not send a correction, and do not explain the taxonomy in the reply. The person asking is clearing one line in a vendor review, and a paragraph about attestation standards reads as evasion when all they wanted was a PDF.

Two practical notes. Most SOC 2 reports go out under an NDA, so expect to attach one before the file leaves your side. And read the request itself: Type 1 and Type 2 are different documents, and a buyer who wrote “certificate” often has no idea which one their security team needs. Type 1 versus Type 2 covers how to tell them apart from the wording of the email.

What SOC 2 certification cost covers here

Type 1: $4,000 one time

The platform, the gap analysis, thirteen policies written from your own stack, the evidence binder mapped to criteria, and the first examination with the independent partner auditor engagement fee sitting inside that number. No second invoice arrives from the CPA firm.

Type 2 monitoring: $600 per month

Continuous evidence collection and deviation tracking on a 12-month term. The first year can be settled as one $6,000 invoice instead, two months free versus paying monthly, after which the subscription continues monthly.

Each Type 2 examination: $5,000

Purchased once the 3-month observation window closes, at the same price every time, including your first one.

That is the whole price list. It does not move with headcount, and nobody has to book a call to hear it. The full cost breakdown sets these numbers against the rest of the category, auditor fee on its own line, every outside figure sourced.

Why the price is so hard to find anywhere else

Gated pricing is the reason a question this simple takes an afternoon to answer. Two examples, both opened and read on the date shown:

• Vanta lists four plans on its pricing page and no dollar figure. The call to action is to request personalized pricing. Source, checked 2026-07-30.
• Drata has no public pricing page. The URL serves the homepage, where the calls to action are to contact sales or book a demo. Source, checked 2026-07-30.

Neither company is doing anything unusual. Quotes get built per account, and a public number makes that harder to hold. The side effect is that most of the published figures about what SOC 2 costs come from parties who do better when the number sounds large.

What arrives at the end

A SOC 2 report has a shape, and it is the same shape at every firm because the AICPA defines it.¹ Four parts, in order.

1. The independent service auditor’s report. The opinion itself. Two or three pages, signed by the CPA firm, and the only part most buyers read closely.
2. Management’s assertion. Your own written statement about the system and the controls, which is the thing the firm then examines.
3. The system description. What your service does, who operates it, where the boundary of the audited system sits, and which subservice organizations you depend on.
4. Controls and results. Every control mapped to the Trust Services Criteria it satisfies.³ In a Type 2 this section also carries the tests performed and any exceptions found.

Read the first part and the last part when a vendor sends you theirs. The opinion tells you whether it is clean or qualified. The results tell you what actually broke. Our guide to the Trust Services Criteria explains what the five criteria cover and which of them belong in a first scope.

A report does not expire, it goes stale

This is the second thing the word certification quietly breaks. Certificates expire on a date. A SOC 2 report never expires, because it describes a period that has already happened and that period does not stop being true.

What changes is how buyers read it. A Type 1 is as of a single date. A Type 2 covers a window, usually three to twelve months. Once the period end is more than a year behind you, most security teams stop accepting the report, which is why companies run a new examination every year rather than renewing anything.

The gap between two reports is covered by a bridge letter, a short signed statement from you saying nothing material has changed since the period end. Expect to be asked for one. It is your document rather than the auditor’s, and it carries no opinion.

Before you pay anyone

1. Ask what the auditor fee is on its own. If it is not inside the quoted price it is arriving later, and you cannot compare two quotes until you know what it is.
2. Ask whether the first examination is included, or whether the number you were quoted only buys software and a dashboard.
3. Ask what year two costs before you sign for year one. Renewal is where compliance pricing moves.
4. Ask who signs. It should be a licensed U.S. CPA firm, and any firm can be checked against its state board register in a minute.⁴

Timing is the only thing left. With evidence organized and policies written, a Type 1 is audit-ready starting at about a week, and the examination then runs on the firm’s schedule. How it works lays out the sequence from questionnaire to signed report.