Menu
SOC 2 Type 2
Bottom line
SOC 2 Type 2 is an AICPA attestation, not a certification. A licensed CPA firm tests both design and operating effectiveness of controls across a 3–12 month observation period. Auditor fees run $12K–$100K; total program cost typically $50K–$220K.
One of 10 compliance framework explainers we maintain.
Key facts
- Controls
- 5 Trust Services Criteria categories (Security required; Availability, Confidentiality, Processing Integrity, Privacy optional). 9 Common Criteria with 64+ points of focus.
- Recertification cycle
- Annual (each report covers the next observation period)
- Ongoing oversight
- Continuous evidence collection across the 3–12 month observation period
- Common gap categories
- Access management (CC6); Change management (CC8); System monitoring (CC7); Vendor management (CC9)
- Related standards
- SOC 1SOC 3ISO 27001HIPAA Security Rule
What is SOC 2 Type 2?
An AICPA attestation report, using the 2017 Trust Services Criteria (revised 2022), that evaluates both the design and operating effectiveness of controls over an observation period of 3–12 months.
Is SOC 2 Type 2 a certification or an attestation?
SOC 2 Type 2 is an attestation issued by an independent CPA firm, not a certification. The AICPA sets the criteria; the auditor issues the opinion. The report is confidential by convention and shared under NDA.
Who needs SOC 2 Type 2?
Required by enterprise buyers, healthcare orgs, and financial services customers as a vendor security prerequisite. The de facto standard for B2B SaaS at Series B and beyond.
What does SOC 2 Type 2 cost and how long does it take?
Range
$12K–$100K / 6–15 months
Auditor fees of $12K–$100K spanning a 3–12 month observation period plus fieldwork. Total first-year cost including readiness tools and internal labor often runs $50K–$220K.
One thing to watch
Auditor fees are the smallest line item. Total first-year cost usually splits roughly 30/40/30 across audit fees, readiness tooling, and internal engineering time.
Sources
Last verified 2026-05-13. Found a stale or wrong source? Email hello@soc2auditors.org.