Menu
Auditors
Our picks by fit, each with a passed peer review
Every listed firm, filterable by price and timeline
Consultants
Readiness, pentest, vCISO, and ISO 27001 firms in one list
Software
Every platform we profile, with sourced prices and fit
Our picks by buyer fit, with the tradeoffs
Published prices, add-ons, and audit fees
Learn
Articles on cost, controls, timelines, and auditor choice
Free Tools
A few questions, then your best-fit auditors
Fit-ranked platforms with observed price bands
Category·14 articles
SOC 2 is an attestation report: a CPA firm tests controls against the AICPA Trust Services Criteria, nearly always Security, plus any of availability, confidentiality, processing integrity, or privacy. Type 1 tests design on one date; Type 2 tests operation, usually over 3 to 12 months.
Start here if SOC 2 is new to you. These guides cover what the report actually is, who needs one, and how the Trust Services Criteria map to the controls a buyer will test.
4 articles
Start with SOC 2 Compliance Guide.
Get the official SOC 2 logo from the AICPA with a free account. See which mark fits Type 1 or Type 2 and what to say while SOC 2 is in progress.
Read insight →SOC 2 compliance means a licensed CPA firm examined a company's controls and issued a report. There is no certificate. See what each claim proves.
Read insight →Learn the six-step path into SOC 2 audit work, how CISA differs from CPA licensure, and what experience helps you join a CPA firm's SOC practice.
Read insight →What SOC 2 requires: the mandatory Common Criteria CC1–CC9, four optional categories, what the audit needs, and the guide for each requirement area.
Read insight →3 articles
Start with SOC 2 Compliance Guide.
Proposed 2027 SOC 2 criteria would cut the criteria from 61 to 50, effective for engagements beginning on or after 31 December 2027 if final.
Read insight →The five SOC 2 Trust Services Criteria categories, the 61 criteria behind them (CC1–CC9, A1, PI1, C1, P1–P8), and which categories your report needs.
Read insight →The five Processing Integrity criteria, PI1.1 to PI1.5: what each asks, the control and evidence an auditor tests, a billing job example, and when to add it.
Read insight →7 articles
Start with SOC 2 Compliance Guide.
SOC 2 Type 2 reports are usually renewed every year, but no AICPA standard requires it. See the Type 1 and Type 2 cycle, period lengths, and report gaps.
Read insight →Learn how a SOC 2 observation period works, how to choose a 3, 6, or 12-month window, and what evidence to collect before a Type 2 audit.
Read insight →You cannot pass or fail a SOC 2 audit. The auditor issues an opinion, and a qualified or adverse one or a disclaimer is what "failing" means for deals.
Read insight →Complementary User Entity Controls (CUECs) explained: what they mean in a vendor's SOC 2 report, why they exist, and the concrete steps to review and act on them as a buyer.
Read insight →SOC 2 exceptions vs qualified opinions: what each means, how to evaluate vendor reports with findings, and how to respond when your own audit flags one.
Read insight →A SOC 2 Type 2 report is a CPA firm's opinion on whether controls worked over a period. See its four core parts, four opinion types, and what to check first.
Read insight →SOC 2 Type 1 covers control design on one date; Type 2 adds operation over a period. Compare timing, fees, and buyer acceptance, then choose.
Read insight →Got the fundamentals down and ready to see who actually runs the audit? Browse every firm in the directory.