Procurement sent the questionnaire on a Tuesday. Question 14 asked for your most recent SOC 2 Type 2 report. You wrote “in progress,” because that felt better than “no,” and eleven days later the champion emailed to say security had flagged it and they were going with the incumbent. Forty thousand dollars, gone over a document.
The instinct now is to start an audit immediately so it never happens again. Hold that thought a week, because the sequencing matters more than the decision.
SOC 2 is a sales asset with a lead time, not a security project. You cannot buy one quickly at any price, because a Type 2 report covers how your controls operated across a stated period, and that period has to actually elapse. So the real question is not whether to get one. It is when to start relative to your pipeline, and what you hand a buyer in the months before you have anything.
Several things unblock a stalled deal faster than a report does, and most founders skip past all of them. Some are free and available this week.
What SOC 2 actually is, and what founders get wrong
SOC 2 is not a certification, and nobody “passes” it. The AICPA describes System and Organization Controls as “a suite of service offerings CPAs may provide in connection with system-level controls of a service organization.” That is the whole shape of it: a licensed CPA firm performs an examination and issues an opinion. No certificate, no registry, no governing body that inspects you.
What gets examined is your controls against the AICPA’s Trust Services Criteria, covering five categories: security, availability, processing integrity, confidentiality and privacy. The AICPA’s guide is titled SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. Note the “or.” Categories are selected, not mandatory. Every SOC 2 includes security, expressed as the common criteria; the other four are scope decisions, and each costs money.
This trips up anyone arriving from ISO or PCI: there is no fixed list of controls you must implement. You describe your system, define your own controls, and the auditor tests whether they were suitably designed and, in a Type 2, whether they operated. Two companies can hold clean reports and run wildly different security programmes.
The distinction that decides your timeline: a Type 1 report addresses whether controls were suitably designed as of a specified date, while a Type 2 also addresses whether those controls operated effectively throughout a specified period. Point in time versus over time. Buyers almost always mean Type 2, because design tells them what you intended and operation tells them what you did. Any experienced reviewer knows a Type 1 can be assembled in weeks by a company that turned on MFA the day before the auditor looked.
The observation window governs everything else
Every option flows from one mechanic. A Type 2 opinion covers a period, that period is named in management’s assertion and in the auditor’s opinion, and the auditor tests evidence generated during it. You cannot backfill it. If your access review did not happen in March, no amount of budget produces a March access review in September.
The attestation standards do not prescribe a minimum length. The period must be long enough to support an opinion, a judgement your auditor makes. Market practice for a first report is a shorter window, often around three months, with mature companies running twelve-month periods for continuous coverage. Ask two auditors what they will sign for a first-year startup and you get two answers, which tells you it is negotiable.
The sequence: scope the system, remediate the gaps, wait out the window, fieldwork, then the auditor writes and issues. Remediation is the part founders underestimate. Logging, access control, change management, onboarding and offboarding, vendor review, backup testing, an incident response plan somebody has actually read. Add it up honestly and a company starting from nothing is looking at the better part of a year before a Type 2 lands in a buyer’s inbox. Put that in front of your board, and in front of the customer who asked.
What it costs, and why published figures are unreliable
- Auditor fees. Usually fixed, driven by scope, number of categories, number of systems and how messy your evidence is.
- The compliance automation platform, if you use one. Annual subscription, typically tiered by headcount and frameworks.
- A penetration test. Not named as a required control in the criteria, but most auditors expect one as evidence and buyers ask for it separately anyway.
- Your own engineering time. By a wide margin the largest item, and the one nobody quotes. If two engineers lose a third of their time for four months, price that at your fully loaded cost and compare it to the audit fee. It will not be close.
Which is why “SOC 2 costs $X” articles are close to useless. They quote the auditor fee alone, usually published by someone with an interest in the number looking small, and they cannot account for your scope, your starting maturity, or how much of your infrastructure was configured by a founder at 2am in 2023. Note also that the AICPA’s own guidance sits behind a paywall, at roughly $100 to $125 for the SOC 2 guide, which is why almost everything you find when you search was written by a company selling compliance software. Get three real quotes with your system description in front of the firm. The only other price in this piece is one I can point at: the Cloud Security Alliance charges $595 for its optional Valid-AI-ted validation of a STAR self-assessment, free to corporate members.
Seven things to try before you capitulate
The deal may not have died over the absence of a report. It may have died because you had nothing to put in the gap.
1. Answer the questionnaire properly. Founders treat it as a form to clear; the reviewer reads it as a writing sample. “Yes” in every box with no detail reads worse than an honest “not yet, here is the compensating control, here is when.” Name the mechanism, offer evidence, flag the two or three things you genuinely do not do.
2. Publish a CAIQ on the CSA STAR Registry. The most underused move available to a small SaaS company. The Cloud Security Alliance’s Cloud Controls Matrix is a cloud security control framework of 197 control objectives across 17 domains, free for internal organisational use, and the Consensus Assessments Initiative Questionnaire ships with it. STAR Level 1 is a self-assessment: complete the CAIQ, submit it, it is published publicly on the registry, and it must be updated annually. Costs nothing, takes a fortnight.
It is self-assessed, so never imply it is an audit. What it does is convert “we have nothing” into “here is our control position, line by line, against a recognised cloud framework, published where anyone can check it.” For a reviewer whose real worry is that you have never thought about any of this, that lands. It also kills most of your questionnaire workload, because you answer from it.
3. Consider ISO/IEC 27001 instead, if your buyers are not American. ISO calls it “the world’s best-known standard for information security management systems,” with over 70,000 certificates across 150 countries as of 2022, and European and multinational procurement often asks for it by name. ISO itself certifies nobody; certification comes from accredited conformity assessment bodies. It is an alternative destination, not a faster one. Count your last twenty questionnaires and let them decide.
4. A Type 1 as a credible interim step. Because it addresses design as of a date, there is no window to wait out, so it arrives far sooner. Some reviewers accept it alone for a lower-risk deployment; more accept it paired with a contractual Type 2 date. If your buyer’s policy names Type 2, it will not clear the gate. The work feeds the Type 2 either way, so it is rarely wasted.
5. Know what a bridge letter actually is. A bridge letter, or gap letter, is issued by you, not your auditor, and covers the period between the end date of a report you already hold and today, asserting nothing material has changed. It is not a substitute for having a report. Ask a prospective auditor for one when you have no SOC 2 at all and you have told the room you do not know how this works.
6. A signed roadmap with a date and teeth. Not “we plan to pursue SOC 2.” A named auditor under engagement, a stated window with start and end dates, the categories in scope, and a contractual delivery date with the customer’s right to terminate without penalty if you miss it. Buyers who reject a vague intention will often accept a dated commitment with an exit attached, because it moves the risk back onto you.
7. A security page with genuine detail. Most are three paragraphs about how seriously you take security. Useless. Publish what a reviewer would otherwise ask for: subprocessors and what each touches, data residency, encryption and who holds the keys, retention and deletion, whether SSO and SAML are available and on which plans, backup restore testing cadence, your vulnerability disclosure contact, when your last penetration test was and by whom. Every item you publish is a question you never answer twice.
Talk to the security reviewer, not your champion
Your champion is relaying a verdict they do not understand and cannot change. Ask plainly for fifteen minutes with whoever reviewed you. A surprising number say yes, because security reviewers mostly prefer talking to engineers over reading forms. Then ask three questions, in this order. “Is the SOC 2 requirement a hard policy or a risk-based threshold?” “If it’s risk-based, who owns the exception, and what have they accepted before?” “What would you need to see from us instead?” That last one usually produces a shorter list than you feared, because the reviewer’s real worry is narrower than the questionnaire suggests. Often it is one thing: production data access, where backups live, or whether support engineers can read customer records.
Your strongest lever is reducing what you touch, because risk scales with data. Run the deployment without customer PII, or with a tenant-scoped key the customer controls, or with a shorter term and fewer users, and you have changed the risk calculation instead of arguing about it. Offer that before offering discount. A pilot with no production data and a 90-day term is a far easier exception to sign off.
And ask your champion the uncomfortable one: was security the reason, or the reason they gave? Sometimes the compliance gate is a polite way of losing on product or price. One of those is worth a year of engineering time. The other is not.
Scope, platforms and auditors: where the money actually goes
The auditor prices what you put in front of them, and first-timers put far too much there, then pay twice: once in fees, once in remediation on systems no customer asked about.
- Narrow the system description. The report covers a defined system, not your company. Scope the product buyers ask about and its supporting infrastructure. Your marketing site, internal analytics and the legacy thing two customers still use do not belong inside the boundary.
- Take security only, first time. It satisfies most buyer questionnaires. Add availability if you sell uptime commitments, confidentiality if contracts demand it, processing integrity mainly if you compute something financial or clinical. Privacy is expensive and rarely what anyone asked for. Adding categories next year is easy; removing them looks like a downgrade.
- Settle carve-out versus inclusive for subservice organisations before scoping starts. The carve-out method excludes your cloud provider’s own controls from your examination and is what nearly every small SaaS company uses.
Compliance automation platforms are genuinely useful and consistently oversold. They pull evidence from your cloud and identity providers, maintain policy templates, map controls to criteria and keep the audit portal organised. With no compliance person on staff, worth paying for. What they do not do is the remediation. No platform rebuilds your access model, segments your network, or writes the incident response plan you will actually follow. They do not shorten the observation window, because nothing does. And a policy generated from a template nobody has read becomes a liability the moment an auditor asks your CTO to walk through it.
For the auditor, ask: Are you a licensed CPA firm, in which state, and can I see your most recent peer review? Who performs the fieldwork, and are they your employees? How many SOC 2 examinations have you issued for companies on our stack? How long from fieldwork ending to report issued? Is the fee fixed, and what is year two? Will you tell us when you see a problem, or will we find out when we read the exceptions?
One more founders never think to ask: what is your commercial relationship with the compliance platform you just recommended? The AICPA’s professional ethics staff has published guidance specifically on firms’ business arrangements with SOC tool providers, which tells you the question is live enough to be worth asking.
Year two, and when to walk away instead
SOC 2 is an annual cost, not a project with an end. Buyers want a current report, generally one covering a period that ended within the last twelve months, which is exactly why bridge letters exist. Successive Type 2 periods are expected to be contiguous, and a gap between them is the sort of thing a decent reviewer notices. Budget the auditor fee, platform subscription, pen test and internal evidence work as recurring, forever. The CSA equivalents keep the same rhythm: STAR self-assessments must be updated annually, STAR Attestation listings expire after a year unless refreshed.
Which brings the honest judgement call. Should you start a compliance programme for one $40,000 deal?
On that deal alone, no. Year one will very likely cost more than $40,000 once engineering time is priced properly, and it costs again every year after. Starting a permanent recurring commitment to win one annual contract is a bad trade, and founders make it constantly because losing feels worse than overspending.
Start when the pattern is a pattern. Three or more deals gated on it in two quarters, or a segment you are deliberately moving into where every buyer will ask. Track it: add a closed-lost reason for security review, and count the deals that stalled before the questionnaire as well as the ones that died on it. Then the decision makes itself, and you have a pipeline number to set against the spend instead of an anecdote.
If the answer today is not yet, say so cleanly. “We don’t have one. Here’s our published CAIQ, here’s what we do and don’t do, here’s the date we’d commit to if this deal justifies starting.” Some buyers still walk. The ones who do not are telling you something useful about whether they were ever going to be an easy customer.
If the real blocker is that you cannot produce the evidence, AB7 Solutions works at that end of it: penetration testing and VAPT that satisfies both the auditor and the questionnaire, SOC monitoring, firewall and server security work, and augmented engineers who can take the remediation backlog off your product team instead of pausing your roadmap for four months. To talk through which gap to close first, call +1 321 341 7733, email ab@ab7solutions.com or director@ab7solutions.com, or start at www.ab7solutions.com.
Questions founders ask next
Can I get a SOC 2 in 30 days like the ads say? You can get a Type 1 quickly. Not a Type 2, because the period has to elapse and your controls have to generate evidence during it. Any claim otherwise describes a Type 1, or readiness work, or nothing.
Does it cover GDPR or HIPAA? No. An examination can include the privacy category and map to other frameworks, but a report is no defence to a regulator and it is not a business associate agreement. Handle those separately.
Will I get a clean report if I have findings? Possibly. A Type 2 can contain exceptions and still carry an unqualified opinion, depending on severity. Buyers read that section. A few well-explained exceptions with remediation dates is normal and rarely kills a deal.
Sources: AICPA & CIMA, SOC 2 resources and System and Organization Controls (SOC) suite of services; AICPA, 2017 Trust Services Criteria with Revised Points of Focus (2022); Cloud Security Alliance, Cloud Controls Matrix v4.1 and CAIQ, STAR Level 1 Self-Assessment and STAR Attestation; ISO, ISO/IEC 27001:2022. Pricing beyond the two published figures quoted is deliberately omitted: get quotes against your own system description.
Digital health companies have one more decision to make: whether HIPAA or SOC 2 comes first.
Related reading
Related AB7 service: cybersecurity and compliance services (managed SOC, VAPT).
[…] it can shorten procurement, but the audit and preparation take months and budget. Our article on what to try before starting SOC 2 covers alternatives when a single deal is […]