Here’s a five-question Q&A on all things SOC 2. It’s based on our team’s collective 124 years of security and compliance experience, and it’s straight to the point.
Do I Really Need SOC 2?
Yes, if you have customers and prospective customers asking for it. Or you anticipate them asking for it in 3-6 months. Otherwise, don’t get SOC 2 if you don’t need it—audits are miserable enough already.
What’s the Difference Between Type 1 and Type 2?
Either read this blog, or check out the chart below.
When Should I Start Prepping for SOC 2?
If you’re short on time: Now, especially if clients and prospects are asking for proof of SOC 2 and or it’s holding back your sales deals. Once you start prep, you can confidently tell clients that you’ll get SOC 2 in the near future.
If time is not an issue: Whenever works best. We recommend you go straight to Type 2 so you only prep for and pay for one audit.
How Much Does SOC 2 Cost?
In our experience, we’ve seen total costs ranging from as high as $120K ($90K for prep + $30K for the audit) to as low as $12K total. Reputable vendors typically charge $20K – $50K in total.
Nowadays, you can find everything from bargain basement prices (and quality of work) to the Cadillac of SOC 2 prep—make sure you do due diligence and comparison shop. And use our SOC 2 ROI guide to help you get realistic ballpark prices when you’re comparing vendors and auditors.
Can I just go straight to Type 2?
Yes, especially if you’re not in a rush and want to get all of it done the first time around (check out our EZ SOC 2 program to go straight to Type 2 and save $22,000).