What is SOC 2 compliance?

SOC 2 (Service Organization Control 2) is the dominant compliance framework for SaaS companies, MSPs, and any service organization that holds customer data. It's not legally required — but enterprise customers increasingly require their vendors to be SOC 2 certified before signing contracts.

SOC 2 Type I vs. Type II

• Type I: Point-in-time assessment — auditor evaluates the design of controls on a specific date. Quicker, less expensive, less weight.
• Type II: Period assessment — auditor evaluates the operating effectiveness of controls over a 6-12 month period. More credibility, what enterprises actually want.

The five Trust Services Criteria

• Security (always included) — protection against unauthorized access
• Availability — system is available for operation as committed
• Processing Integrity — system processing is complete, valid, accurate, timely
• Confidentiality — confidential information is protected
• Privacy — personal information is collected, used, retained, disclosed in conformity with commitments

Most organizations start with just Security (the "Common Criteria"), then add Availability and Confidentiality as needed. Privacy is rare unless GDPR/CCPA exposure exists.

What SOC 2 actually requires

• Documented information security policies
• Risk assessment process with regular updates
• Access control with MFA and least-privilege
• Vulnerability management program
• Change management procedures
• Vendor management (third-party risk assessment)
• Security awareness training for all staff
• Incident response procedures with regular testing
• Logging, monitoring, and alerting
• Business continuity and disaster recovery planning
• Background checks for employees with sensitive access

Timeline and cost

Most organizations need 6-12 months of readiness work before audit, then a 12-month audit period for Type II. Total first-year cost: $30K-$120K depending on complexity (readiness work + audit fees + tooling). Annual recurring: $20K-$60K. Tools like Drata, Vanta, and Secureframe automate much of the evidence collection.