SOC 2 Compliance for MSPs: Scoping and Audit Guide

SOC 2 compliance for MSPs is an independent CPA attestation that your managed-service control plane — the RMM, PSA, backup stack, identity tools, and people who run them — meets the AICPA Trust Services Criteria. This guide is for MSP owners and security leads pursuing their own report, not MSPs helping clients through a client audit.

A SOC 2 report gives enterprise buyers proof that your internal controls work, not just that you recommend good practices to clients. The audit tests how you secure privileged access, run change management, retain evidence, and govern the vendors in your stack.

Why SOC 2 Matters in the MSP World

MSPs sit in an awkward supply-chain position. Clients hand you admin access to their environments, then ask whether you are audited. A SOC 2 Type 2 report answers that question with tested evidence instead of a security questionnaire and a logo slide.

Security is mandatory in every SOC 2 examination. Most MSP reports also include Availability (when you publish uptime or recovery commitments) and Confidentiality (when technicians can reach sensitive client data). Processing Integrity and Privacy apply only when your service model actually processes transactions or personal information at scale.

Moving Beyond a Checkbox Mentality

Sophisticated buyers — especially in finance, healthcare, and enterprise SaaS — treat an MSP SOC 2 report as a vendor gate. The report is an auditor’s opinion on whether your controls meet AICPA criteria, not a marketing badge.

A useful report proves you can:

• Restrict privileged access to RMM, PSA, and cloud consoles (Security, Common Criteria).
• Monitor, patch, and respond across the systems you operate for clients (CC7.1 and related criteria).
• Reduce supply-chain risk for clients evaluating your firm alongside their other vendors.

For MSP sales teams: a current Type 2 report short-circuits weeks of security diligence. Lead with scope, criteria, and the observation period — not a generic “we take security seriously” slide.

A Framework for Trust and Growth

The audit itself forces documentation you will need anyway: onboarding and offboarding, access reviews, backup testing, incident response, and vendor oversight. Teams that treat SOC 2 as an operating program — not a one-time project — run the next cycle with far less scramble.

Scoping Your Audit: An MSP-Specific Approach

Scope is the highest-leverage decision in an MSP SOC 2 program. Over-scoping pulls client-specific environments, legacy tools, or business units into a report buyers do not need. Under-scoping produces a clean opinion on a system description that does not match what you actually sell.

Draw the MSP Control-Plane Boundary First

For an MSP, the audited “system” is the infrastructure, software, people, processes, and data you use to deliver in-scope managed services — not every endpoint in every client tenant unless you explicitly promise to control it.

Start with the components that can compromise multiple clients if misused:

Component	Why auditors care	Typical evidence
RMM platform	Holds agent keys and remote-access paths into client environments	MFA enforcement, RBAC groups, session logs
PSA tool	Tracks changes, credentials, and client work	Change tickets, approval workflows, offboarding records
Backup / BDR stack	Stores recoverable client data in your tenancy	Job success reports, annual restore tests
Managed security tools (EDR, SIEM, vuln scanners)	Shows how you detect and remediate	Scan exports, remediation tickets, alert runbooks
Cloud tenants hosting your tools or client data	Defines where data lives and who can reach it	IAM policies, encryption settings, logging
Identity provider (Microsoft Entra ID, Okta, etc.)	Gates admin access to the tools above	Quarterly access-review exports, MFA status

Scoping rule: tell the auditor exactly which services the report covers — for example “managed infrastructure and backup” — and list the tools and teams that deliver them. Buyers read the system description before they read the opinion.

Run a compliance risk assessment before you lock scope. It surfaces which client commitments (uptime, confidentiality, data handling) force which Trust Services Criteria into the report.

Subservice Organizations in the MSP Stack

Nearly every MSP depends on vendors that touch in-scope data or operations. CBIZ’s 2024 SOC Benchmark Study found 89.6% of SOC 2 reports included subservice organizations, up from 82% the prior year. For MSPs, typical subservices include your RMM vendor’s cloud, hyperscaler hosting, backup SaaS, email security, and identity platforms.

Your auditor will ask how those providers appear in the report:

Treatment	What it means for an MSP	Practical example
Carve-out	The auditor tests your controls over the vendor relationship, not the vendor’s internal controls	You monitor the RMM vendor’s SOC report and contract terms; their data center is carved out
Inclusive	Selected vendor controls are folded into your system description and tested with yours	Less common for MSPs unless the vendor function is inseparable from your service delivery

If a critical subservice is carved out, your report will list Complementary Subservice Organization Controls (CSOCs) — the activities you rely on that provider to perform. CBIZ reports an average of roughly 10 CSOCs across SOC 2 reports in the 2024 study. Omitting major subservices (cloud host, RMM cloud, backup provider) is a red flag to buyers and auditors.

Our carve-out vs. inclusive method guide explains which treatment most service organizations end up with and why. Collect each subservice’s SOC report or equivalent assurance during readiness, not during fieldwork.

Selecting the Right Trust Services Criteria

Security is mandatory. Add other criteria only when your contracts or service commitments require them:

• Security (Common Criteria): Access management (CC6.x), change management (CC8.1), monitoring and vulnerability response (CC7.x). Every MSP report includes this baseline.
• Availability: Include when you publish uptime SLAs or managed recovery commitments. A1.3 expects tested recovery — a DR plan alone is not enough.
• Confidentiality: Include when technicians routinely access sensitive client information (M&A data, PHI under BAA, financial records). C1.1 expects confidential information to be identified and protected commensurate with sensitivity.
• Processing Integrity: Rare for pure MSPs; relevant only when you process transactions where accuracy and completeness are contractual (payroll file handling, billing operations).
• Privacy: Include when you collect, store, or process personal information beyond incidental contact data.

Buyer expectations have shifted. In CBIZ’s 2024 analysis of 73 SOC 2 reports, Confidentiality appeared in 64.4% (up from 34% in 2023) and Availability in 75.3%. Security-only reports still exist, but enterprise MSP buyers increasingly expect Availability and Confidentiality when your MSA mentions uptime or data handling.

A structured SOC 2 readiness assessment is the fastest way to align scope, criteria, and evidence before you sign an auditor engagement letter.

Type 1 vs Type 2: Which Report MSPs Should Pursue First

Reddit threads and MSP forums converge on the same question: jump straight to Type 2 or stage with Type 1? The answer depends on whether you need a point-in-time design opinion or proof that controls ran all year.

	Type 1	Type 2
What it tests	Control design at a specific date	Design and operating effectiveness over an observation period (typically 3–12 months)
Evidence burden	Policies, configurations, screenshots at a point in time	Continuous logs, tickets, reviews across the full period
Buyer weight	Acceptable for earlier-stage vendors or first conversations	Expected for mature enterprise and regulated-industry deals
MSP fit	Useful when controls are new but sales needs a report now	Standard target for MSPs selling to finance, healthcare, and mid-market SaaS

Most MSPs aiming at enterprise clients should plan for Type 2. A common path is Type 1 to validate scope and close design gaps, then roll immediately into a Type 2 observation period. Waiting until “everything feels ready” often delays revenue; starting the observation period while remediation continues is normal — as long as exceptions are documented and fixed.

For observation-period length and sequencing detail, see how long a SOC 2 audit takes.

Implementing Controls and Gathering Evidence

Auditors test operating effectiveness, not policy binders. For MSPs, the win is generating evidence from tools your technicians already use.

Mapping Controls to Daily MSP Operations

Translate AICPA criteria into tickets, logs, and exports your team produces every week:

• Security (CC6.1 — logical access): Role-based groups in RMM and PSA; MFA on every admin account. Evidence: permission screenshots plus quarterly access-review exports from your identity provider.
• Availability (A1.3 — recovery testing): Managed BDR with documented annual restore tests. Evidence: backup job success reports and test results with named owners and remediation items.
• Confidentiality (C1.2 — disposal): Client offboarding checklist executed in the PSA. Evidence: closed ticket showing secure deletion from production, backups, and shared drives, with sign-off.

Automating Evidence Collection: The MSP Advantage

Audit mindset: if it is not logged, it did not happen. Retain RMM, PSA, and IdP data for the full Type 2 observation period plus auditor lookback.

• Change management (CC8.1): Dedicated PSA change-request workflow with approval timestamps and post-implementation notes.
• User access reviews (CC6.3): Quarterly exports from Microsoft Entra ID or Okta listing privileged accounts on in-scope systems — archived with reviewer sign-off.

Mapping MSP Services to SOC 2 Trust Services Criteria

Trust Service Criterion	Example MSP Control or Service	Applicable AICPA Requirement (Example)	Why It Matters for an MSP
Security	Mandatory MFA on all administrative accounts for the RMM, PSA, and cloud consoles.	CC6.1 — Restricts logical access to authorized individuals.	Auditors scrutinize privileged MSP accounts because one compromise affects many clients.
Availability	Documented annual failover testing of managed backup and disaster recovery (BDR) services.	A1.3 — Tests recovery procedures against availability objectives.	Proves BDR is operated, not shelfware — buyers read restore tests closely.
Confidentiality	Data classification policy with encryption for client data in your cloud tenant.	C1.1 — Identifies and protects confidential information.	Expected when finance or healthcare clients ask how you handle sensitive files.
Security	Monthly vulnerability scans on in-scope servers with remediation tracked in the PSA.	CC7.1 — Detects configuration changes and newly discovered vulnerabilities.	Patch drift is the most common policy-vs-reality gap in MSP audits.

Build these into standard operating procedures so the next audit is evidence collection, not archaeology.

Navigating Common Pitfalls in an MSP’s SOC 2 Journey

CBIZ’s 2024 benchmark of 193 SOC reports found 54.9% carried at least one control exception. User access reviews (15.6% of exceptions), terminations (12%), and change management (11.7%) topped the list — all daily MSP workflows.

The Policy-vs-Reality Gap

A policy stating critical patches deploy within 30 days fails when RMM exports show 60- or 90-day lag on in-scope servers. That contradiction becomes a CC7.1 exception fast.

Incomplete Evidence

Scenario: annual security awareness training ran, but nobody kept attendance records.

Result: the auditor sees slides, not proof that the training control operated — exception.

If you cannot prove it, you did not do it. RMM logs, PSA tickets, and IdP reports are your evidence repository.

Mis-Scoping the Audit Boundaries

Omitting a backup cloud, a colocation site, or the RMM vendor’s hosted control plane produces a system description buyers cannot trust. Map subservices early and match the narrative in your report to how you actually deliver services.

CUECs Your Clients Will Inherit

Your MSP SOC 2 report will list Complementary User Entity Controls (CUECs) — things clients must do for your controls to work (maintain endpoint antivirus, notify you of personnel changes, restrict local admin rights). Enterprise clients read this section. Document realistic CUECs during readiness so sales and delivery tell the same story. See our complementary user entity controls guide for how buyers evaluate them.

Choosing Your Auditor and Understanding the Costs

You are hiring a licensed CPA firm to attest against AICPA standards. For MSPs, industry fluency matters as much as brand: auditors who understand RMM/PSA evidence ask better questions and waste less fieldwork on tool education.

Large National Firm vs. Boutique Specialist

• Large national firms: Brand recognition for Fortune 500 procurement; higher cost; risk of junior staff without MSP context.
• Boutique specialists: Often faster, cheaper, and staffed with auditors who have seen ConnectWise, Datto, Kaseya, or Autotask evidence before. Mid-market and tech buyers usually weight clarity over logo.

Match the firm to the buyers you chase. Traditional enterprises may want a household name; SaaS and mid-market clients typically prefer a readable report from an MSP-experienced firm.

A Data-Driven Approach to Selecting an Auditor

SOC2Auditors.org tracks attestation-capable CPA firms with fee ranges, timelines, and industry tags. The SOC 2 auditors for MSPs directory applies the current MSP and managed-security tags from the live dataset. Filter by budget and turnaround before you take five sales calls.

Across the full directory, Type 2 fees typically run $15K–$400K+ depending on scope, criteria count, and firm tier. MSP-focused firms in our dataset currently quote Type 2 engagements from roughly $10K to $120K for standard managed-service scope — higher when multi-region delivery, all five criteria, or complex subservice chains are in play.

Decoding the Costs and Timelines

Cost Driver	Why It Impacts Price	Example Cost Influence
Audit Scope	More criteria and more in-scope systems mean more control points.	Security-only may start near $15,000; all five TSCs can exceed $75,000.
Report Type	Type 2 covers 3–12 months of operating evidence.	Often 30–50% more than Type 1 at the same firm.
Company Size & Complexity	More techs, offices, and tenants expand sampling.	A 20-person MSP costs far less than a 200-person multi-region operator.
Auditor Reputation	Brand premium on top of the same scope.	Big Four pricing can roughly double a boutique quote for identical criteria.

For selection criteria beyond price, see how to choose a SOC 2 auditor.

Your SOC 2 Report Is Done. Now What?

A SOC 2 report is valid for about 12 months from the opinion date. The next observation period starts immediately — treat compliance as a program with named owners.

Moving From a Project to a Program

Cadence	Owner	Control tie-in
Quarterly access reviews	Service delivery manager	CC6.3 — RMM, PSA, cloud consoles
Monthly vulnerability scans	Senior engineer	CC7.1 — scan, ticket, remediate, close
Annual DR test	Service delivery lead	A1.3 — documented restore with outcomes

Bake Compliance Into Daily Workflow

Compliance automation platforms can pull MFA status, backup success, and policy attestations from your stack continuously. Whether you use a GRC tool or PSA checklists, the goal is the same: evidence appears when work happens, not when the auditor emails a list.

Turn the Report Into a Sales Asset

1. Streamline due diligence: Give sales a one-page scope summary (criteria, system boundary, period, subservices).
2. Publish a trust center: Host the report letter, criteria, and CUEC summary behind an NDA gate if needed.
3. Unlock regulated verticals: Finance, healthcare, and enterprise SaaS procurement often require a current Type 2 before contract signature.

Embedding controls in operations turns the annual audit into confirmation, not a fire drill.

---

Finding the right SOC 2 auditor is a critical first step for an MSP. Compare firms with managed-service experience in the SOC 2 auditors for MSPs directory, or use the broader auditor directory if your service model is closer to SaaS than managed operations.