SOC 2 for Early-Stage SaaS: Cost, Timeline and Scope

A SOC 2 report is not a certification and there is no such thing as being “SOC 2 certified.” It is an attestation report written by a licensed CPA firm about controls you designed yourself, against criteria published by the AICPA. For a seed or Series A SaaS company the real questions are narrower than the marketing suggests: which of the five trust services categories you put in scope, whether you buy a Type I first, and what the whole exercise costs in cash and engineering weeks.

The five categories, and why four of them are optional

SOC 2 engagements are performed against the AICPA’s trust services criteria. The 2017 Trust Services Criteria, with revised points of focus issued in 2022, set out five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. The AICPA describes them as criteria “for use in attestation or consulting engagements to evaluate and report on controls over” those domains.

Security is the only mandatory one. It is delivered through the common criteria, numbered CC1 through CC9, which map onto the COSO internal control framework and cover control environment, communication, risk assessment, monitoring, logical and physical access, system operations, change management and risk mitigation. Everything else is elective.

Most early-stage SaaS companies should scope Security only, or Security plus Availability if they sell an uptime SLA. Adding Confidentiality is cheap if you already classify customer data. Adding Privacy is not: it pulls in notice, choice, consent, retention and disposal obligations that overlap with GDPR-style programmes and roughly doubles the evidence surface. Processing Integrity belongs to companies that transform financial or transactional data on a customer’s behalf, and almost nobody else needs it.

Type I versus Type II, and the observation window

A Type I report gives an auditor’s opinion on whether controls were suitably designed as at a single date. A Type II adds an opinion on whether those controls operated effectively across a stated period. The AICPA’s illustrative reporting templates confirm the two report types exist and are written to the SSAE-21 reporting requirements; the illustrative service auditor’s SOC 2 Type II report is published separately from Type I guidance for exactly that reason.

That period is the observation window, and it is the single biggest driver of your timeline. Three months is the usual floor for a first Type II, six months is common, and twelve months is what mature vendors renew on. The window cannot be backdated: your auditor samples evidence generated while the controls were live, so a three-month window that starts the day you finish implementation ends no sooner than three months later.

Whether to buy a Type I first is a sales question, not a security one. A Type I closes deals while the clock on your Type II window runs, and it forces the documentation work early. If no deal is blocked on it, skip it and put the money into the Type II.

What it actually costs

Published figures vary widely because “SOC 2 cost” bundles at least four different line items. Linford & Co, a CPA firm that performs these audits, states that SOC audit costs “typically range from $20,000 to $150,000, with a median price around $30,000,” and that Big Four engagements start in the low six figures. Compliance-automation vendor Drata publishes a narrower breakdown: Type I at $7,500 to $15,000 for small and midsize companies, Type II at $12,000 to $20,000 for the same band, with Type II priced 30% to 50% above Type I; gap assessments at $5,000 to $25,000; penetration testing at $5,000 to $15,000; and total first-year spend of roughly $28,000 for a 25-person startup, against roughly $75,000 at 100 employees.

A worked budget for a 20-person seed company

The line nobody budgets is engineering time. Expect one senior engineer at roughly 20% for a quarter, plus a founder or ops lead effectively owning the programme. At loaded cost that is frequently larger than the audit fee.

What auditors actually ask for

The evidence requests are more mundane than the framework documents imply. In practice a first Type II turns on whether you can produce, on demand:

• A written, version-controlled policy set with dated management approval, and proof employees acknowledged it.
• An accurate system description: what the service is, what infrastructure it runs on, which subservice organisations you rely on.
• Onboarding and offboarding tickets showing access granted on a documented approval and revoked within your stated SLA. Offboarding is the most commonly failed control.
• Periodic access reviews, with the review artefact and the remediation of anything found.
• Change management evidence: pull requests with a reviewer who is not the author, linked to a ticket, with CI passing.
• A risk assessment performed at least annually, with owners and treatment decisions, not a spreadsheet of generic threats.
• Vendor due diligence files, including the SOC 2 reports of your own critical subprocessors.
• An incident response plan plus evidence of at least one test or a real incident handled under it.
• Backup and restore evidence. Auditors increasingly want a restore test, not a backup log.

Two structural points save real money. First, narrow the system boundary in the description to the production service; pulling your marketing site and internal analytics stack into scope buys nothing. Second, use the carve-out method for subservice organisations such as AWS wherever your auditor allows it, so their controls are excluded from your opinion rather than tested through it.

SOC 2 or ISO 27001

ISO/IEC 27001:2022, published on 25 October 2022, is a management-system standard rather than an attestation. It requires you to build an ISMS and demonstrate it to an accredited certification body, which issues a certificate rather than a report. Its Annex A contains 93 controls grouped into organizational, people, physical and technological themes, down from 114 controls across 14 domains in the 2013 edition, and organisations select applicable controls through a Statement of Applicability rather than implementing all of them.

If your pipeline is US-heavy, start with SOC 2. If it is European or you sell to enterprises with a procurement checklist written in ISO language, 27001 first. The control work overlaps heavily enough that doing the second one costs far less than the first.

What to do in the next 30 days

Decide the category scope before you talk to an auditor, and write it down: Security only, plus Availability if you have an SLA. Pick the observation window based on when a named deal needs the report, then work backwards. Get three fixed-fee quotes from boutique firms and one from a mid-tier regional firm, and ask each for their evidence request list up front, because comparing those lists tells you more about the engagement than the price does. Then run your own gap analysis against CC1 through CC9 before buying a readiness assessment. Most seed-stage companies fail on the same four things: offboarding timeliness, access reviews that were never performed, change management with self-approved merges, and a risk assessment that does not exist. Fix those four and the audit fee is the least interesting number in the project.

Sources

• AICPA & CIMA — 2017 Trust Services Criteria with Revised Points of Focus (2022)
• AICPA & CIMA — SOC 2: SOC for Service Organizations, Trust Services Criteria
• AICPA & CIMA — Illustrative Service Auditor’s SOC 2 Type 2 Report
• Linford & Co — SOC 1 & SOC 2 Audit Costs: An Auditor’s Price Breakdown
• Drata — How Much Does a SOC 2 Audit Cost?
• Linford & Co — Trust Services Criteria: SOC 2 Audit Guidance
• ISO — ISO/IEC 27001:2022 Information security management systems
• GAICC — ISO 27001 Annex A Controls List: All 93 Controls by Theme