Menu
Key facts
- Controls
- 5 Trust Services Criteria categories (Security required; Availability, Confidentiality, Processing Integrity, Privacy optional). 9 Common Criteria with 64+ points of focus.
- Recertification cycle
- Annual (each report covers the next observation period)
- Ongoing oversight
- Continuous evidence collection across the 3–12 month observation period
- Common gap categories
- Access management (CC6); Change management (CC8); System monitoring (CC7); Vendor management (CC9)
- Related standards
What is SOC 2 Type 2?
An AICPA attestation report, using the 2017 Trust Services Criteria (revised 2022), that evaluates both the design and operating effectiveness of controls over an observation period of 3–12 months.
Is SOC 2 Type 2 a certification or an attestation?
SOC 2 Type 2 is an attestation issued by an independent CPA firm, not a certification. The AICPA sets the criteria; the auditor issues the opinion. The report is confidential by convention and shared under NDA.
Who needs SOC 2 Type 2?
Required by enterprise buyers, healthcare orgs, and financial services customers as a vendor security prerequisite. The de facto standard for B2B SaaS at Series B and beyond.
What does SOC 2 Type 2 cost and how long does it take?
Auditor fees of $12K–$100K spanning a 3–12 month observation period plus fieldwork. Total first-year cost including readiness tools and internal labor often runs $50K–$220K.
Auditor fees are the smallest line item. Total first-year cost usually splits roughly 30/40/30 across audit fees, readiness tooling, and internal engineering time.