SOC 2 readiness and implementation
It usually starts with a large customer asking for your SOC 2 report and naming a date. We take you from where you are to a clean audit: we find the gaps, fix them with you, write the policies, set up the compliance platform, and manage the auditor. Type 1 starts at $9,500. A Type 2 program starts at $15,000.
What's included
- A gap assessment against the SOC 2 Trust Services Criteria
- The full set of written policies
- Control implementation: access reviews, multi-factor authentication, logging, device management, vendor management, onboarding and offboarding, change management
- Setup of Vanta, Drata, or Secureframe, or a spreadsheet if a platform is overkill for you
- Choosing an auditor and managing the relationship
- Evidence preparation and support during audit fieldwork
Not included
- The audit itself. A licensed CPA firm issues the report, typically for $5,000 to $15,000 for Type 1 and $10,000 to $35,000 for Type 2.
- The compliance platform subscription, typically $7,500 a year and up.
- A penetration test, typically $4,000 to $8,000, if your auditor or customer requires one.
What SOC 2 costs in the first year
For a company of about 50 people. Everything a SOC 2 needs, not just our part.
| Readiness and implementation (us) | $9,500 to $15,000 |
|---|---|
| CPA audit, Type 1 or Type 2 | $5,000 to $35,000 |
| Compliance platform, per year | $7,500 to $25,000 |
| Penetration test, if required | $4,000 to $8,000 |
| First-year total | about $26,000 to $83,000 |
How long it takes
Type 1 takes about three to four months from kickoff to report. Type 2 adds an observation period of three to twelve months before the audit.
What changes the price
- Number of people and devices
- Regulatory exposure: SEC or FINRA oversight, payments, banks as customers
- How many SaaS tools and cloud accounts you run
- How much cleanup your environment needs before we can run it
- Which frameworks and how much of the business are in scope
- Deadlines, such as a customer who needs a SOC 2 report this quarter
Recent work
A cybersecurity company
We took them through SOC 2. A security company has to prove its own security before customers will buy.
Questions
- Type 1 or Type 2?
- Type 1 shows your controls are designed correctly on one date. Type 2 shows they worked over a period, usually three to twelve months. Many customers accept a Type 1 to start, with a Type 2 to follow. Ask your customer which one they need before you spend money.
- Do we need Vanta or Drata?
- Not always. For most companies over about 20 people, a platform saves enough evidence work to pay for itself. Below that, a well-kept spreadsheet and a good auditor can cost less. We will tell you which fits.
- Can you do the audit too?
- No. The auditor has to be independent of whoever built your controls. We recommend CPA firms that work with companies your size.
- How much of our time does it take?
- Plan on two to four hours a week from one person on your side, and more during the weeks we implement controls.
- What does the second year cost?
- Usually 30 to 50% less than the first, because the controls and policies already exist.
Talk to us
Tell us what's driving it: a customer deadline, a questionnaire, an exam, or IT that has outgrown whoever handles it now. A first call takes 30 minutes, and you'll leave knowing whether we're a fit and roughly what it costs.
Book a 30-minute callor send a message, or email contact@birchny.com.