SOC 2 Type II Certification Guide: Preparation, Evidence Collection, and Audit Readiness
SOC 2 Type II is the most requested security assurance report in the B2B SaaS market. Enterprise customers, particularly in financial services, healthcare, and government, require SOC 2 Type II reports as a condition of vendor onboarding. Unlike a Type I report which captures whether controls are suitably designed at a point in time, Type II validates that controls have been operating effectively over a continuous observation period, typically 6 to 12 months. The audit examines evidence that controls were actually performed, not just that procedures were documented.
The American Institute of Certified Public Accountants (AICPA) defines the SOC 2 framework through the Trust Services Criteria (TSC), which covers five areas: Security (CC categories, required for all SOC 2 reports), Availability, Processing Integrity, Confidentiality, and Privacy. Most organizations scope their SOC 2 to Security plus one or two additional criteria most relevant to their customers. This guide covers the full process from initial scoping and gap assessment through evidence collection, auditor selection, and maintaining certification through annual renewals.
SOC 2 Type I vs Type II: Key Differences
Understanding the distinction between Type I and Type II is essential for setting customer and stakeholder expectations correctly.
SOC 2 Type I evaluates whether controls are suitably designed at a specific point in time. An auditor reviews your control documentation, configuration evidence, and policies as of the report date and opines on whether the design is adequate to meet the applicable Trust Services Criteria. Type I does not evaluate whether controls were actually performed consistently over time.
SOC 2 Type II evaluates both the design adequacy and the operating effectiveness of controls over an observation period. The auditor reviews evidence that each control was performed consistently throughout the period: access reviews were conducted monthly, vulnerability scans ran weekly, change management records exist for every significant change, penetration tests were performed within the required window. Type II requires a minimum 6-month observation period; most organizations use 12 months for the annual renewal cycle.
Which report to pursue first: Type I serves as a readiness milestone and can be issued 4 to 8 weeks after completing a gap assessment and implementing missing controls. It signals to customers that controls are in place, even if operational history has not yet accumulated. Organizations are typically advised to pursue Type I first while running through their first Type II observation period. Some enterprise customers accept Type I initially but require Type II within 12 to 18 months.
What Type II does not cover: SOC 2 reports describe the controls of a service organization relevant to the security of customer data, not the security of the organization overall. Internal systems outside the scope definition are not evaluated. The scope is a critical decision: scoping too broadly increases audit complexity and cost; scoping too narrowly may not satisfy customer requirements. Common scope decisions: include production infrastructure and customer data processing systems; exclude internal corporate systems, HR systems, and non-production environments.
The Five Trust Services Criteria
SOC 2 reports are organized around the AICPA Trust Services Criteria. Security (Common Criteria, CC) is required in every SOC 2 report. The other four are optional and selected based on customer requirements and the nature of the service.
Security (Common Criteria, CC): The Security criteria contain 33 Common Criteria (CC1 through CC9) covering: the control environment (CC1, organizational oversight and accountability), communication and information (CC2), risk assessment (CC3), monitoring of controls (CC4), control activities (CC5, logical and physical access controls), logical and physical access controls (CC6), system operations (CC7), change management (CC8), and risk mitigation (CC9). CC6 and CC7 generate the most evidence requests and most common findings; they cover authentication, access provisioning and review, vulnerability management, and incident detection.
Availability (A): Addresses whether the system is available for operation and use as committed. Relevant if your customers rely on your service for critical operations and availability SLAs are material to your contract commitments. Evidence includes uptime monitoring records, incident records, capacity planning documentation, and disaster recovery test results.
Processing Integrity (PI): Addresses whether system processing is complete, valid, accurate, timely, and authorized. Most relevant for financial processing, payroll, and transaction systems where incorrect processing is a material risk. Evidence includes data validation controls, error handling logs, and reconciliation procedures.
Confidentiality (C): Addresses whether information designated as confidential is protected as committed. Relevant when customers contractually require you to protect their confidential information. Evidence includes data classification policies, encryption configurations, and access controls on confidential data repositories.
Privacy (P): Addresses the collection, use, retention, disclosure, and disposal of personal information in conformity with AICPA privacy principles. Most relevant for organizations handling consumer PII or subject to GDPR or CCPA. Evidence includes privacy notices, consent mechanisms, data subject request processes, and data retention and deletion records.
Choosing which criteria to include: Most SaaS organizations include Security plus Availability, which satisfies the majority of enterprise customer requirements. Adding Confidentiality is appropriate when customer contracts include explicit confidentiality commitments. Processing Integrity is necessary for financial technology and payroll processing. Privacy is increasingly requested as GDPR and CCPA enforcement intensifies.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Evidence Collection Requirements by Criteria
SOC 2 Type II auditors request evidence that each control operated throughout the observation period. Understanding evidence requirements before the observation period starts lets you build collection workflows rather than scrambling during the audit fieldwork phase.
Access management evidence (CC6.1-CC6.3):
- User access provisioning records showing approval for each new access grant during the period
- Quarterly or semi-annual user access reviews with evidence of completion and remediation of excess access
- Privileged account inventory and access review
- Terminated user offboarding records showing account disabling within the defined SLA
- MFA enrollment records for all user accounts
Vulnerability management evidence (CC7.1):
- Vulnerability scan reports on a defined cadence (weekly for external-facing systems is common)
- Evidence of remediation for critical and high-severity findings within SLA
- Penetration test report from within the audit period
- Patch deployment records for critical patches
Change management evidence (CC8.1):
- Change request records for all significant changes to in-scope systems during the period
- Evidence of testing and approval for each change
- Emergency change records with post-implementation review documentation
Incident management evidence (CC7.3-CC7.5):
- Incident log for all security events during the period
- Evidence of incident response procedure execution for each logged incident
- Post-incident review documentation for significant incidents
Risk assessment evidence (CC3.1-CC3.4):
- Annual risk assessment documentation with date and approver
- Risk register with residual risk ratings
- Evidence that risk assessment results informed control decisions
Practical evidence collection workflow: Build automated evidence collection into your operations from day one of the observation period. Configure your identity provider (Okta, Entra ID) to export monthly access review reports automatically. Schedule vulnerability scan reports to be saved to an audit evidence repository. Create a ticketing workflow that captures change approval records in a format that maps directly to audit requests. Compliance automation platforms (Vanta, Drata, Secureframe) automate this collection by integrating with your tool stack via API.
Common Control Gaps That Cause Audit Findings
Qualified opinions and findings in SOC 2 Type II reports are almost always predictable. These are the control areas where auditors most frequently identify deficiencies.
Access review failures: The most common finding. Organizations define a quarterly user access review process in policy but fail to conduct the review on schedule, fail to document completion, or fail to remediate excess access identified during the review. Fix: build access reviews into a ticketing system with mandatory completion dates and assign specific owners. Document every access change made as a result of the review. Auditors want to see evidence that excess access was identified and removed, not just that a list was generated.
Terminated user access: Accounts not disabled within the committed SLA (often 24 to 48 hours after termination). This is frequently caused by HR-IT notification gaps, particularly for contractor and third-party personnel. Fix: automate offboarding triggers from the HR system to your identity provider so accounts are disabled automatically when a termination record is created.
Vendor/third-party risk management: Inadequate documentation of vendor security assessments, missing business associate agreements or data processing addendums, or failure to conduct annual vendor reviews for high-risk vendors. Fix: maintain a vendor risk register with review dates and document the assessment criteria and results for each vendor with access to in-scope systems.
Penetration testing gaps: No penetration test during the observation period, or a test that was conducted but findings were not remediated within the committed timeline. Fix: schedule the penetration test in the first half of the observation period so remediation time exists before the audit fieldwork phase.
Change management documentation: Undocumented changes deployed to production systems, or emergency changes without post-implementation review. Fix: enforce change tickets as a prerequisite for production deployments via CI/CD pipeline gates. Make the change ticket mandatory in the deployment workflow so it cannot be bypassed.
Missing or outdated policies: Policies not reviewed and reapproved within the committed annual review cycle. Fix: schedule annual policy reviews as recurring calendar events with assigned owners. Use a document management system that tracks policy version history and approval dates.
Auditor Selection and Compliance Automation Tools
Selecting the right auditor and using compliance automation tools are the two decisions with the greatest impact on audit efficiency and cost.
Choosing a SOC 2 auditor: SOC 2 audits must be conducted by a licensed CPA firm. Selection criteria: experience with technology companies and SaaS specifically (auditors unfamiliar with cloud infrastructure request irrelevant evidence and miss real risks), responsiveness and communication quality during the sales process (predicts audit experience), fixed-fee vs. time-and-materials pricing (fixed-fee protects against scope creep), and references from similar-stage companies. Cost range: $15,000 to $40,000 for a first-year Type II audit for a startup; $40,000 to $100,000+ for larger organizations with complex infrastructure. Larger firms (Deloitte, PwC, Grant Thornton) carry brand recognition but smaller specialized firms (Schellman, Prescient Security, Johanson Group) often provide better service for growth-stage technology companies.
Compliance automation platforms: Automation platforms reduce manual evidence collection burden by 60 to 80 percent through API integrations with your tool stack.
-
Vanta: The most widely used platform for SOC 2 in the SaaS market. Integrates with AWS, GCP, Azure, GitHub, Okta, Jira, and 100+ other tools. Automatically collects evidence for configured controls and provides a readiness percentage dashboard. Also supports ISO 27001, HIPAA, PCI DSS, and GDPR. Pricing: approximately $10,000 to $30,000 per year depending on organization size.
-
Drata: Strong competitor with similar integration breadth. Notable for its continuous monitoring model that alerts on control failures in real time rather than at audit time. Supports audit evidence room that auditors access directly, reducing back-and-forth.
-
Secureframe: Lower price point targeting earlier-stage companies. Supports major compliance frameworks with a simpler interface. Less extensive integration library than Vanta or Drata.
-
Tugboat Logic (acquired by OneTrust): Strong policy management and vendor risk management alongside controls automation.
Do you need a compliance automation platform? For organizations with significant tool stack breadth, yes. Manual evidence collection for a first SOC 2 audit involves dozens of hours gathering screenshots, exports, and records from multiple systems. Automation platforms pay for themselves in staff time savings within the first audit cycle and provide continuous monitoring that catches control failures before the auditor does.
The bottom line
SOC 2 Type II certification is achievable for any organization with the right preparation approach: conduct a gap assessment using the Trust Services Criteria, build evidence collection workflows into your operations before the observation period starts, focus remediation effort on access management and change management where findings are most common, and use a compliance automation platform to reduce the manual burden. Plan 9 to 18 months from gap assessment to a clean first Type II report. Pursue Type I as a milestone if customers need proof of controls before your Type II observation period is complete.
Frequently asked questions
What is the difference between SOC 2 Type I and SOC 2 Type II?
SOC 2 Type I evaluates whether controls are suitably designed at a single point in time. SOC 2 Type II evaluates whether controls have been operating effectively over an observation period, typically 6 to 12 months. Type I can be obtained within weeks of implementing controls; Type II requires accumulating operational evidence over the observation window. Enterprise customers almost always require Type II; Type I is a useful interim step while running through the first observation period.
How much does a SOC 2 Type II audit cost?
First-year SOC 2 Type II audit fees typically range from $20,000 to $50,000 for growth-stage SaaS companies using a specialized audit firm, and $50,000 to $100,000+ for larger organizations or those using Big Four firms. Add compliance automation platform costs of $10,000 to $30,000 per year. Internal staff time for evidence collection and remediation adds significant cost in the first year, often equivalent to one to three months of a security engineer's time. Annual renewal audits typically cost 20 to 30 percent less than the initial audit.
What security controls are required for SOC 2?
SOC 2 does not prescribe specific controls. It evaluates whether your controls are suitably designed and operating effectively relative to the Trust Services Criteria. Common controls that satisfy the Security criteria include: MFA on all systems, quarterly access reviews, vulnerability scanning on a defined cadence, annual penetration testing, formal change management process, incident response program, and vendor risk management. The specific design of each control is your choice; the auditor evaluates whether it achieves the criteria outcome.
How long does a SOC 2 Type II audit take from start to finish?
The full process from gap assessment to receiving the final report typically takes 12 to 18 months for a first-time certification. Breakdown: 1 to 3 months for gap assessment and control implementation, 6 to 12 months for the observation period, 1 to 2 months for auditor fieldwork and report finalization. Organizations with mature existing security programs can sometimes complete the process in 9 months by implementing gaps quickly and using a 6-month observation period.
Do you need all five Trust Services Criteria for SOC 2?
No. Security (Common Criteria) is the only required criteria for all SOC 2 reports. The four optional criteria (Availability, Processing Integrity, Confidentiality, Privacy) are included based on customer requirements and the nature of your service. Most SaaS companies include Security plus Availability for the majority of enterprise customer needs. Adding criteria increases audit scope and cost, so include only what your customers actually require or what reflects material risk in your service.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is an audited report issued by a CPA firm attesting to the operating effectiveness of specific controls over a defined period, primarily valued in North American markets. ISO 27001 is a certifiable management system standard audited by an accredited certification body, widely recognized in European and international markets. SOC 2 is more flexible on specific control design; ISO 27001 requires implementation of a full ISMS with documented controls from Annex A. Many global organizations pursue both, as they complement each other and share significant control overlap.
Can a compliance automation platform replace security controls?
No. Compliance automation platforms like Vanta and Drata automate evidence collection and monitoring but do not implement security controls. They collect evidence that your controls are operating, they do not operate the controls themselves. You still need the underlying security infrastructure: MFA enforcement, access review processes, vulnerability scanning, and incident response procedures. The automation platform saves 60 to 80 percent of the manual effort involved in gathering evidence those controls were performed.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.
The Mythos Brief is free.
AI that finds 27-year-old zero-days. What it means for your security program.