The good news is that SOC 2 is more manageable than its reputation suggests, especially with automation tools like the CyberKainos Aegis Platform. This SOC 2 guide covers what it is, the choices you need to make up front, the steps to your first report, where first audits go wrong, and what it all costs.
What SOC 2 actually is
SOC 2 is an independent audit of how your company protects customer data. It was developed by the AICPA, and only a licensed CPA firm can issue the report.
- It’s not a law. No regulation requires it, but enterprise buyers treat it as mandatory. Our advice is that you do as well.
- It’s an attestation, not a certification. The auditor gives an opinion on your controls; there’s no “certified” badge.
- You write your own controls. Unlike ISO 27001, which prescribes controls, SOC 2 is principle-based. You decide how to meet each criterion, and the auditor checks you consistently do what you said.
- The report is confidential. It’s shared with customers under NDA, not published.
The five Trust Services Criteria
Only Security is mandatory, and most first audits cover Security alone. Add others only when a customer or contract asks for them; each one adds controls, evidence and audit fees.
| Criterion | Required? | Add it if… |
|---|---|---|
| Security | Yes | Always included: access control, monitoring, change management, vendor risk |
| Availability | Optional | You sign uptime SLAs or customers depend on you being up |
| Confidentiality | Optional | You hold contracts, IP or other sensitive business data |
| Processing integrity | Optional | You run payments, payroll or calculations where errors matter |
| Privacy | Optional | Personal data is central to your service |
Security is split into nine “common criteria” (CC1–CC9). CC6, logical and physical access, is where most audit findings turn up.
Type I vs Type II
A Type I report checks your controls are designed properly on a single date. A Type II checks they actually worked over an observation period of 3–12 months. Enterprise buyers increasingly accept only Type II.
If a deal needs something soon, use the “staircase” approach: Get a Type I around month 3, start the Type II observation period straight away, and have a Type II report by month 10 or 11. With no deadline pressure, many companies skip Type I and run a short first Type II instead.
The journey, step by step
Most first SOC 2 projects follow six steps:
- Define your scope. A good rule of thumb: anything that touches production customer data is in; development and staging usually aren’t.
- Run a readiness assessment. Treat it as a mock audit that produces a list of gaps. Skipping it is one of the most common causes of blown budgets and painful audits.
- Close the gaps. Typical fixes: written policies, SSO and MFA everywhere, offboarding tied to HR, code review before production, logging and alerting, staff security training, and vendor reviews. If a gap can’t be fixed yet, document the risk and your plan.
- Pick your auditor and ask for the PBC list. The “prepared by client” list is exactly what the auditor will request. Getting it early tells you what evidence to collect from day one.
- Run the observation period (Type II). Operate every control on schedule and capture evidence as it happens, not at the end.
- Complete fieldwork and get your report. The auditor tests samples, interviews staff and issues the report, usually 3–4 weeks after fieldwork.
Where first audits go wrong
Companies rarely struggle for lack of security technology. They struggle because what they wrote down and what they actually did don’t match.
Auditors don’t take your policy’s word for it. In a Type II they sample real events across the period, typically 15–25 samples per control over 12 months. Every miss becomes an “exception” in your report. The usual culprits are:
- Skipped access reviews. Quarterly reviews done in Q1 and Q3 but not Q2 and Q4. Assign an owner and calendar them.
- Leavers keeping access. Auditors compare your leavers list against system access. Tie revocation to HR offboarding, ideally within 24 hours.
- Vendor reports collected but not reviewed. Having a supplier’s SOC 2 report isn’t the control; reviewing and recording it is.
- Changes that skip review. One “quick fix” pushed straight to production is an exception. Enforce approvals technically with branch protection and deployment gates.
- Evidence gathered too late. Reconstructing a year of evidence at audit time rarely works.
- No clear owners. Every control needs a named person responsible for running and evidencing it.
And remember that SOC 2 renews every year. Build controls into everyday tools rather than relying on a pre-audit scramble.
What it costs
A lean first year for a small startup typically costs around £19,000–£30,000 all-in, rising to £34,000–£60,000 for a Type I followed by a Type II.
| Cost component | Typical range (GBP) without the Aegis Platform | SOC 2 costs when using the Aegis Platform |
|---|---|---|
| Audit fee, Type I | £5,000–£19,000 | £5,000–£19,000 |
| Audit fee, Type II | £9,000–£34,000; Big Four firms can top £37,000 | £9,000–£34,000; Big Four firms can top £37,000 |
| Compliance automation platform | £10,000–£20,000 per year | £4,000–£10,000 with the Aegis Platform |
| Internal staff time | £15,000–£45,000, the cost most teams forget | £3,000–£9,000 with the Aegis Platform, which saves up to 75% of staff time |
| Annual renewal audit | 70–80% of the first audit fee | 70–80% of the first audit fee |
To keep fees down, get fixed-fee quotes from two or three firms, including a SOC 2 specialist boutique, and check each has a clean AICPA peer review.
Your quick-start checklist
- Ask your key customers which report type and criteria they need
- Name a SOC 2 project owner and get an executive sponsor
- Draw your scope around production customer data
- Run a readiness assessment against the Security criteria
- Turn on SSO and MFA for every in-scope system
- Get fixed-fee quotes from two or three audit firms, and ask each for their PBC list
- Give every control a named owner and an evidence folder
- Set a start date for your observation period
SOC 2 rewards steady, consistent habits over last-minute heroics. Done well, it does more than unblock deals: it leaves you with a security programme that genuinely protects your customers.
We hope our SOC 2 guide was helpful, if you would like to speak to a SOC 2 expert you can click here to start a conversation or email hello@cyberkainos.com
