SOC 2 is not a certification a vendor sells you. It is an attestation report an independent, licensed CPA firm writes after examining your actual controls, and a company with no security team can still get one, just not quickly and not for free. The realistic path runs a readiness gap assessment first, closes the gaps that matter, then starts an observation window with the CPA firm, three to twelve months for a Type II report, before the firm issues anything. Cost follows scope and control maturity, not headcount, and DSE does not publish a flat SOC 2 price because no honest one exists across that range of starting points.
This guide covers what the report certifies, the calendar from a standing start, what moves the fee, and a scorecard for how ready you are.
Why a customer is asking for this specific report
Most small and mid-sized companies do not pursue SOC 2 out of curiosity. A larger customer’s procurement or security team asked for it, usually after your company crossed a size or data-sensitivity threshold inside their own supplier risk program. The NIST Cybersecurity Framework (CSF) 2.0 GOVERN Function’s Cybersecurity Supply Chain Risk Management category (GV.SC) is the reason: a customer that prioritizes suppliers by criticality eventually asks higher-risk suppliers for independent evidence rather than a self-reported questionnaire, and a SOC 2 report answers a dozen questionnaire rows at once.
That is why SOC 2 is worth pursuing deliberately rather than reactively. If you are still answering one-off questionnaires by hand, see how to answer a security questionnaire with no security team first; the point where a reusable report replaces repeated custom answers is usually the trigger for reading this guide.
What the report actually is, and is not
A SOC 2 report is issued by an independent, licensed CPA firm under AICPA attestation standards, built on the AICPA’s Trust Services Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is mandatory in every report; the other four are added only when your actual service commitments call for them, so a SaaS company promising uptime adds Availability. A Type I report answers whether controls are suitably designed as of a specific date; a Type II report tests whether those controls actually operated, consistently, across an observation window most CPA firms set between three and twelve months. Enterprise buyers increasingly treat Type I as a stepping stone and ask for Type II at renewal, since a control switched on last week has not been tested by anything.
| What people assume | What actually happens |
|---|---|
| “SOC 2 certified” | There is no SOC 2 certification; the correct term is an issued attestation report |
| A consultancy can issue the report | Only an independent, licensed CPA firm can issue a SOC 2 report |
| All five Trust Services categories are required | Only Security is mandatory; the rest are added based on your actual commitments |
| The report proves you cannot be breached | The report evidences that defined controls existed and, for Type II, operated over the window; it is not a guarantee against compromise |
The realistic timeline from a standing start
This is the part that catches companies with no security team off guard: the controls take longer to become real than the paperwork takes to write.
- Readiness gap assessment, two to six weeks. Map current controls against the Trust Services Criteria you need, and get an honest register of what exists, what is partial, and what is missing. This is advisory work; it is not the attestation itself.
- Gap remediation, four weeks to several months. This varies most, and headcount has the least to do with it. A company with named owners, a real identity provider, and a tested backup process can close gaps in weeks; one starting from an informal environment often needs a quarter or more, since controls must run long enough to leave evidence.
- Type I report, optional, two to four weeks after controls are in place. Some customers accept this as a bridge while the Type II window runs; it is faster, cheaper, and weaker evidence.
- The Type II observation window, three to twelve months. Fixed by the examining CPA firm, not by DSE, and it cannot be compressed by paying more.
- Audit fieldwork and report issuance, four to eight weeks after the window closes. The CPA firm reviews evidence, requests samples, and issues the final report.
From a cold start, twelve to eighteen months from kickoff to a first Type II report is realistic, most of it consumed by remediation and the observation window. An organization already running most Security criteria informally can target a Type I in a few months and a Type II inside a year.
What actually drives the cost
DSE does not publish a flat SOC 2 readiness fee; the range between a mature environment and a standing start is too wide for one number to be honest. In rough order of impact:
| Driver | Increases cost and time when |
|---|---|
| Starting control maturity | No named control owners, no documented policies, no existing identity governance |
| Trust Services Criteria selected | Adding Availability, Processing Integrity, Confidentiality, or Privacy beyond the mandatory Security criteria |
| System and vendor complexity | Multiple production environments, multiple cloud providers, or a large subprocessor list that all fall inside the report’s scope |
| Evidence automation | Manual evidence collection versus tooling that captures control evidence continuously |
| Observation window length | A twelve-month Type II window produces more evidence to collect and review than a three-month window |
| CPA firm fees | The audit fee itself is set and billed directly by the independent CPA firm, separate from any readiness work |
Two points are worth stating plainly. The CPA firm fee is not a DSE fee: readiness work is separate from, and in addition to, what the independent firm charges to examine your controls and issue the report, and a proposal that bundles the two into one number is hiding a cost center, not simplifying your bill. And starting control maturity is the lever you control before any call: an organization that documents its policies and names owners before a readiness review spends less time, and less fee, than one paying someone else to do that discovery.
Published starting tiers for DSE’s other advisory services are at the pricing page; SOC 2 readiness is quoted after a scoping call, since the drivers above move scope more than a list price could reflect.
A self-scoring SOC 2 readiness scorecard
Score your organization 0, 1, or 2 on each row before the first conversation. This tells you, roughly, whether you are closer to a six-month Type I bridge or an eighteen-month build.
| Area | 0 (does not exist) | 1 (partial) | 2 (documented and operating) |
|---|---|---|---|
| Named control owners | No one is accountable for any specific control | Some controls have an informal owner | Every in-scope control has a named, accountable owner |
| Written policy set | No security policies exist in writing | A few policies exist, outdated or unapproved | A current, approved policy set covers the Security criteria |
| Access reviews | Access is granted and never reviewed | Access reviewed occasionally, no fixed cadence | Access reviewed on a defined, evidenced cadence |
| Change management | Changes ship with no record of review or approval | Some changes are reviewed, inconsistently | Every production change has a recorded review and approval trail |
| Incident response | No written plan | A plan exists but has never been tested | A written, tested plan with a defined escalation path |
| Vendor and subprocessor tracking | No list of vendors with access to in-scope data | A partial list exists, not reviewed | A current list of vendors and subprocessors, reviewed on a cadence |
| Evidence collection | No mechanism to show a control ran, beyond someone’s memory | Evidence exists but is scattered across tools and inboxes | Evidence is collected centrally as controls run, ready for sampling |
Total your score out of 14. Below 7, expect remediation to run several months before any observation window can start. Above 10, most raw material already exists, and the work is closer to formalizing and evidencing what you already do.
Sequencing: what to do this month
- Pick the Trust Services Criteria you actually need. Match categories to the commitments you make customers today, not to what sounds thorough.
- Name control owners before writing a single policy. A policy with no owner is a document, not a control; auditors sample owners, not paragraphs.
- Start the observation clock as early as possible. Since the window cannot be compressed, the fastest path to Type II is getting real controls operating sooner, not rushing the audit at the end.
- Separate the readiness engagement from the CPA examination in writing. Confirm who does readiness work and who issues the report before signing anything; an examiner who also built your controls is not independent.
Georgia and metro Atlanta companies building this into an ongoing program can see how a part-time security leader keeps the control set current between renewals at fractional CISO leadership for Atlanta and Georgia small businesses.
Questions buyers ask
Can DSE issue our SOC 2 report?
No. Only an independent, licensed CPA firm can issue one under AICPA attestation standards. DSE performs readiness work: gap assessment, control build-out, and evidence organization that prepare you for that firm’s examination. The examining firm must be independent of whoever built the controls, which is why those two roles stay separate.
Do we need Type I, Type II, or both?
Most enterprise customers eventually ask for Type II, since it tests whether controls actually operated over a window rather than just existing on a given date. Type I can serve as a bridge while the Type II window runs, but treat it as a stepping stone if your buyers are mid-market or larger.
How much does SOC 2 readiness cost?
There is no published flat fee; price follows starting control maturity, how many Trust Services Criteria categories apply, and system complexity, not headcount. The CPA firm’s examination fee is separate from, and in addition to, any readiness work, and should always be quoted by name rather than bundled. DSE’s other advisory tiers with a published starting structure are at the pricing page.
Can we skip straight to SOC 2 without a general risk assessment first?
You can, but it is usually slower, since a readiness gap assessment covers much of the same ground a general cybersecurity risk assessment already would if you have not had either done yet.
Does a SOC 2 report replace answering customer security questionnaires?
Most of the work, not all of it. A current report answers most rows in a standardized questionnaire by reference, but customers still ask company-specific questions, and some want a bridge letter addressing anything that changed since the report’s period ended. See how to answer a security questionnaire with no security team for what still applies.
What this guide is / What it is not
What it is: A practitioner explanation of SOC 2 scope, timeline, and cost drivers for an organization with no dedicated security team, anchored to the AICPA’s Trust Services Criteria and attestation standards and to NIST CSF 2.0’s GOVERN Function (NIST CSWP 29, February 26, 2024). What it is not: Legal or accounting advice, an audit, a certification, or a guarantee of any compliance, insurance, or examination outcome. DSE performs SOC 2 readiness work, including gap assessment, control build-out, and evidence organization; DSE is not a CPA firm, does not issue SOC 2 reports, and does not guarantee that any independent examination results in an unqualified opinion. The examination itself must be performed by an independent, licensed CPA firm.
The Bottom Line
SOC 2 is a report an independent CPA firm writes about controls you have to build and run first, not something a consultancy can shortcut. The timeline is set by two things neither party can rush: gap remediation from your starting maturity, and the Type II observation window, typically three to twelve months once controls are genuinely operating. Cost follows the same logic, scope and maturity, not headcount, with the CPA firm’s fee always quoted separately. Score your own readiness honestly first, pick only the criteria you need, and start the observation clock as early as the controls support, since nothing after that moves faster for more money.
Ready to scope the compliance readiness work directly? See small-business security posture and compliance readiness for how the gap assessment and control build-out fit together before you engage an independent CPA firm.
Key facts
- SOC 2 is an attestation report issued by an independent, licensed CPA firm under American Institute of Certified Public Accountants (AICPA) attestation standards, built on the Trust Services Criteria; the Security criteria are mandatory in every report and Availability, Processing Integrity, Confidentiality, and Privacy are added only if the service commitment calls for them (AICPA, current 2026).
- A SOC 2 Type I report evaluates whether controls are suitably designed at a single point in time, while a SOC 2 Type II report additionally tests whether those controls operated effectively across an observation window that most CPA firms set between three and twelve months (AICPA, current 2026).