What's Inside

When a prospective customer asks for a SOC 2 report, the first thing you need to know is this: Do they require a Type 2 or will they accept a Type 1 prior to your company completing a Type 2? Both reports will prove SOC 2 compliance with security best practices, but there are some key differences you’ll need to plan for.

Below, we dive into what a SOC 2 Type 2 report is, who needs one, and what the audit process looks like. 

What Is a SOC 2 Type 2 Report?

SOC 2 Type 2 is an audit resulting in a report covering a specified period of time and includes auditing both the design and operating effectiveness of controls. This means you have to show that you have been compliant throughout the audit period (usually between six months and a year). 

The key question here is: Are you consistently compliant and can you prove to an auditor that your controls were designed appropriately and operated effectively? When it comes to security, consistency matters a lot. This is why SOC 2 Type 2 is considered a more valuable report than a Type 1 (and is requested more often).

SOC 2 Type 1 vs. Type 2

The key differences between Type 1 and Type 2 reports are timeline and the subject matter covered. 

SOC 2 Type 1 is a point-in-time report that only covers the design of controls. This means you can start your audit the minute after you get your compliance program fully up and running. A Type 1 report answers the question: Are you compliant today and can you prove to an auditor that controls are appropriately designed?

Benefits of SOC 2 Type 2 Compliance

SOC 2 Type 2 is not the only type of SOC report, but it is the most robust. More often than not, customers and prospective customers will ask for a SOC 2 Type 2 report over a SOC 2 Type 1 report. Having a SOC 2 Type 2 report ready can help you gain new business and assure customers that you have a serious program in place.

Additional benefits of a SOC 2 Type 2 report include:  

• Help you prevent costly data breaches: With the average cost of a data breach at a whopping $9.44 million in 2022, the price of not protecting user data is steep. Not to mention, a large-scale breach can also severely impact your trust with customers and damage your brand reputation for years to come. 

• Assures customers and prospects of your security posture: Working with a third party can (and often does) put your data at risk. That’s why reports like SOC 2 are so crucial in showing—rather than telling—that you’re doing your due diligence to protect data. 

SOC 2 Type 2 Report Scope 

At the foundation of a SOC 2 Type 2 report is the five Trust Services Criteria (TSC). These criteria were created by the American Institute of Certified Public Accountants (AICPA) and make up the backbone of your security posture. 

Exactly what your SOC 2 Type 2 audit scope will be depends on which of the five TSC you choose to measure your company’s cybersecurity against. 

The TSC are:

• Security: Systems and data are protected against unauthorized access and disclosure. 

• Availability: Information and systems can be relied on for operation and use. 

• Processing integrity: System processing is complete, valid, accurate, and timely. 

• Confidentiality: Confidential information is protected. 

• Privacy: Personal information is safeguarded against unauthorized access and use. 

The only TSC that’s required in every SOC 2 report is security. The other criteria are optional and you may choose to measure against them depending on your customers’ unique needs. 

Who Needs a SOC 2 Type 2 Report?

Platform as a service, software as a service, and cloud computing organizations are commonly asked to provide a SOC 2 Type 2 report. Additionally, enterprise-level customers or prospects often require a Type 2 report to move forward with a vendor. 

What Does the SOC 2 Type 2 Audit Process Look Like?

A SOC 2 Type 2 audit will look a little different for each company, depending on which of the TSC you’re measuring against and the complexity of your systems and controls. 

Below is a brief overview of the general SOC 2 Type 2 audit process. 

1. Define your scope: As mentioned, the five TSC provide the structure for your audit and report. Security is the only criteria required in a SOC 2 Type 2 report, so you’ll need to evaluate which (if any) of the other four TSC are necessary for your report. 

2. Choose the time period for your report: It’s recommended your Type 2 report period covers at least six months to one year. 

3. Document your systems and controls: After you determine your reporting period and which of the TSC you’ll pursue, you can begin gathering documentation on relevant security controls and systems. 

4. Perform a gap analysis: Once your systems, controls, and documents are in order, a gap analysis shows you areas an auditor could flag during the official audit process. 

5. Conduct a readiness assessment: A readiness assessment works like a practice run before the official audit. A SOC auditor will complete their own gap analysis, testing controls that are in place and providing recommendations for controls that might not be in place but are needed to satisfy SOC 2 requirements. 

6. Choose an auditor: After implementing the recommendations from the readiness assessment, you can choose a licensed CPA firm to complete your Type 2 audit. 

7. Begin the formal audit: From here, you’ll begin working with your chosen auditor to complete the official SOC 2 Type 2 audit. This process can take anywhere from a few weeks to multiple months and will result in a written SOC 2 report describing your internal control environment. 

How Long Is a SOC 2 Type 2 Report Valid?

Technically, SOC 2 Type 2 reports never expire and are “valid” forever. However, customers want their vendors to have an updated report on at least an annual basis to ensure they can continue to rely on the customers’ internal controls. This is why most companies plan for annual SOC 2 audits. 

How Long Does It Take To Get a Type 2 Report?

Because SOC 2 Type 2 reports cover a period of time, it’s important to plan ahead. Not only will your teams need time to get the required controls in place, but once the compliance program is up and running, you’ll have to wait until the required period has passed before the audit can be performed.

For example, if it takes six months to get your compliance program ready and you need a six-month Type 2 report, you’ll wait one year before you even start your audit (which will likely take another month at least). If your prospective customer is asking for a year-long audit, the wait gets even longer.

This is why it’s important to start on SOC 2 compliance now, even if you haven’t received a request from customers or prospective customers for a Type 2 report just yet. 

How Much Does a SOC 2 Type 2 Audit Cost?

The audit for a small to midsize company working toward a Type 2 report costs an average of $12,000 to $20,000. Large organizations can expect to pay around $30,000 to $100,000 for a Type 2 audit. 

Your audit may cost more depending on the following factors:

• Your audit scope: Whether you decide to include all five Trust Services Criteria in your audit and the complexity of your system and web applications will directly impact the time and effort required to complete your audit. 

• Your team’s workload: While not directly tied into the cost of an audit, your team’s time and productivity could be impacted in the lead-up to an audit as they’re focused on putting security controls in place. 

• New security tools: You should also consider the cost of new tools you’ll need to add to your tech stack, such as endpoint detection tools, security training tools, and a password manager. 

• Penetration testing: This testing can help you prepare for a SOC audit by highlighting vulnerabilities in your current system. 

• The auditor you choose: Expect rate variations among CPA firms, especially when you choose a firm that specializes in SOC 2 audits. Choosing to partner with one of the “Big Four” accounting firms will also significantly add to your audit cost. 

SOC 2 Best Practices 

So, how can you prepare to get your Type 2 report? What are the best practices you should be following in order to achieve and maintain SOC 2 compliance?

Active Management

As with any important program, if nobody owns it, it won’t be maintained. To ensure continuous compliance, someone needs to be assigned the responsibility of checking in and keeping track. Get specific by asking these questions:

• Who is in charge?

• Who will get alerts if something goes wrong?

• What should they check on regularly and how often is “regularly”?

• What ongoing maintenance needs to happen for your compliance to stay up to date—and who is responsible for each aspect of that maintenance?

Continuous Monitoring

SOC 2 Type 2 means you are compliant throughout the specific period of time. To prove that compliance (and fix non-compliance ASAP), you need continuous monitoring in place. It simply won’t work to have your onboarding program go off the rails for three weeks while nobody’s looking.

This is where a partner like Drata can help flag risks before they become problems and help you get ahead of issues before they hurt your audit results.

Confirm Compliance

Once your compliance program is in place—and before the clock starts ticking on your Type 2 compliance period—we recommend confirming that your controls are meeting the high standards put in place by SOC 2.

The best way to do this is to get a Type 1 report as soon as the compliance program is ready. Because it’s a point-in-time report, you won’t have to wait three months or six months or a year. The report can tell you if you are compliant and would pass an audit right now.

This will help you identify any issues before you go into your six-month-plus waiting period (because, trust us, you don’t want to wait six months or more and then find out you missed something important in your setup). Plus, if a prospective customer asks you for a report, you can use the Type 1 to show them you have a serious program in place and are working toward your Type 2.

If you don’t want to do a Type 1 report, you could do a gap analysis instead. But we recommend Type 1 reports because you can still hand them to a prospective customer to prove you’re on your way to Type 2 compliance. 

Prepare for Your Type 2 Report

Ready to get started on that Type 2 report? We’d love to help. Drata automates evidence collection, security monitoring, and compliance operations across your SaaS services. 

SOC 2 compliance automation can be a real game-changer. Trust us—we were trying to run these programs manually before we built the platform!