SOC 2 certification cost (and why it is not a certification)

The vocabulary is wrong and everyone uses it anyway. Buyers ask for a certificate. Founders search for the price of one. The word is in the procurement email and in the security questionnaire, and correcting it in public wins you nothing. Knowing what you bought still decides what you send when a customer asks, and how long that document is worth anything to them.

There is no SOC 2 certificate

ISO 27001 is a certification. An accredited body audits you, issues a certificate, and that certificate carries a number and an expiry date. SOC 2 works differently. The AICPA writes the standards, and a licensed CPA firm performs an examination and reports its opinion on whether your controls meet the criteria you scoped.² No body certifies anyone. Nothing gets stamped.

The deliverable is a report, tens of pages long, carrying the examining firm’s name and its opinion in the first section. There is no wall plaque version, and no public register a customer can look you up in.

What to send when a buyer asks for your certificate

Send the report. Do not send a correction, and do not explain the taxonomy in the reply. The person asking is clearing one line in a vendor review, and a paragraph about attestation standards reads as evasion when all they wanted was a PDF.

Two practical notes. Most SOC 2 reports go out under an NDA, so expect to attach one before the file leaves your side. And read the request itself: Type 1 and Type 2 are different documents, and a buyer who wrote “certificate” often has no idea which one their security team needs. Type 1 versus Type 2 covers how to tell them apart from the wording of the email.

What SOC 2 certification cost covers here

Star: $2,000 one time

The platform, the gap analysis, policies written from your own stack, and the evidence binder mapped to criteria. No Type 1 examination sits at this price.

A Type 1 report: $2,000 more

Added to Star when you are ready: the Type 1 examination by the independent partner auditor and the report. No second invoice arrives from the CPA firm.

Orbit: $7,800 a year

Continuous evidence collection and deviation tracking for up to 50 people, and your SOC 2 Type 2 audit is included in every contract year.

Orbit after Star: the Star payment off the first year

Take Orbit within 12 months of paying for Star and the Star payment comes off your first Orbit year. You can instead pay that year monthly on a 12-month term; the Star payment comes off the yearly price only. Either renews at $7,800 a year.

Constellation: $10,800 a year

Everything in Orbit plus one more framework: ISO 27001 or ISO 42001.

Your SOC 2 Type 2 audit: inside Orbit, every contract year

It starts on its own once the 3-month observation window closes. There is nothing to buy at that point and nothing to click.

Those are the SOC 2 prices for a company of up to 50 people, and nobody has to book a call to hear them. Over 50 people, or three or more frameworks, is Mission, priced to your scope. How much SOC 2 costs sets these numbers against the rest of the category, auditor fee on its own line, every outside figure sourced, and the SOC 2 cost calculator totals two years.

What a SOC 2 Type 1 audit costs, starting at

Search results quote Type 1 prices as a starting figure, and the figure depends on who publishes it and what it includes. One vendor’s estimate for the audit fee alone:

• Drata estimates the audit fee for a SOC 2 Type 1 at $7,500 to $15,000 and for a Type 2 at $12,000 to $20,000 for small to midsize companies, and puts the total first-year cost at $25,000 for a small startup. Source.

Here a Type 1 report is $2,000 more on Star. That is a fixed price, not a starting figure, and no second invoice arrives from the CPA firm.

That sits below the audit-fee range above, and a price below the published ranges is a fair reason to ask questions. Practitioners have published the reasoning behind that caution:

• One published practitioner breakdown puts a Security-only Type 2 at 60 to 80 auditor hours, at partner rates of $250 to $350 per hour and staff rates of $100 to $175, giving a stated floor near $9,000. Source.
• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source.

Both points are worth taking seriously. What we hand the firm is evidence organized and mapped to criteria before the examination starts, and the firm is disclosed on request before you sign, so you can look it up yourself. Is a cheap SOC 2 audit legitimate? sets out the five checks that settle it, and they work on us too. What a SOC 2 auditor charges explains what the firm side of the number is made of, and SOC 2 software that publishes its pricing lists the platforms you can price without a call.

One thing is absent: a separate price for the Type 2 audit. On Orbit, your SOC 2 Type 2 audit is included in every contract year.

Why the price is so hard to find anywhere else

Gated pricing is the reason a question this simple takes an afternoon to answer. Two examples, both opened and read on their own pages:

• Vanta lists four plans on its pricing page and no dollar figure. The call to action is to request personalized pricing. Source.
• Drata lists its compliance plans, Foundation, Advanced and Enterprise, on a plans page with no dollar figure, and each plan button leads to a demo request. Source.

Neither company is doing anything unusual. Quotes get built per account, and a number on the website makes that harder to hold. Both do print 12-month software prices on the AWS Marketplace listings they sell themselves:

• Vanta’s own AWS Marketplace listing prices its Essentials package at a starting cost of $14,000 for a 12-month contract, for 1 to 20 employees. Source.
• Drata’s own AWS Marketplace listing prices the Drata Platform Fee, with capacity for a 100 FTE organization, at $25,000 for a 12-month contract, and the SOC 2 framework at $7,500 on a separate line. Source.

Vanta pricing and Drata pricing work through both listings.

What arrives at the end

Most SOC 2 reports follow the same order, the one the AICPA’s illustrative report uses.⁵

1. The independent service auditor’s report. The opinion itself. Two or three pages, signed by the CPA firm, and the part a buyer reads first.
2. Management’s assertion. Your own written statement about the system and the controls, which is the thing the firm then examines.
3. The system description. What your service does, who operates it, where the boundary of the audited system sits, and which subservice organizations you depend on.
4. Controls and results. Every control mapped to the Trust Services Criteria it satisfies.³ In a Type 2 this section also carries the tests performed and any exceptions found.
5. Other information, when there is any. Anything management adds, such as its response to an exception. The opinion does not cover it.

Read the opinion and the controls and results when a vendor sends you theirs. The opinion tells you whether it is clean or qualified. The results tell you what actually broke. Our guide to the Trust Services Criteria explains what the five criteria cover and which of them belong in a first scope.

A report does not expire, it goes stale

This is the second thing the word certification quietly breaks. Certificates expire on a date. A SOC 2 report never expires, because it describes a period that has already happened and that period does not stop being true.

What changes is how buyers read it. A Type 1 is as of a single date. A Type 2 covers a window, usually three to twelve months. Once the period end is more than a year behind you, a security team can stop accepting the report, which is why companies run a new examination every year rather than renewing anything. How long a SOC 2 report is valid covers the detail.

The gap between two reports is covered by a bridge letter, a short signed statement from you saying nothing material has changed since the period end. Expect to be asked for one. It is your document rather than the auditor’s, and it carries no opinion.

Before you pay anyone

1. Ask whether the auditor fee is inside the quoted price. If it is not, it is arriving later, and you cannot compare two quotes until you know what it will be.
2. Ask whether the first examination is included, or whether the number you were quoted only buys software and a dashboard.
3. Ask what year two costs before you sign for year one. Renewal is where compliance pricing moves.
4. Ask who signs. It should be a licensed U.S. CPA firm, and any firm can be checked against its state board register in a few minutes.⁴

Timing is the only thing left. With evidence organized and policies written, a Type 1 is audit-ready starting at about a week, and the examination then runs on the firm’s schedule. How it works lays out the sequence from questionnaire to signed report, and the free readiness assessment tells you how much of that evidence you already have before you spend anything.