Frequently asked questions about SOC 2

Everything you wanted to know but were afraid to ask about SOC 2. From basic questions to practical implementation. For official information, see the AICPA  or check NOREA  (the Dutch professional association for IT auditors) for the Dutch context.

Is SOC 2 mandatory?

No, it is not a legal requirement. No regulator says, “you MUST have SOC 2.”

In practice, though, it is de facto mandatory for many companies:

• US enterprise customers require it in RFPs
• Venture capitalists ask for it during due diligence from Series B onwards
• Compliance officers at large companies have SOC 2 written into their vendor risk policies
• Without SOC 2, you won’t make the vendor shortlists of Fortune 500 companies

So: not legally required, but a business requirement if you want enterprise customers in the US.

If you only have Dutch SMB customers who never ask for it, it is probably overkill. In that case, ISO 27001 makes more sense for the European market.

What is the difference between SOC 1, SOC 2 and SOC 3?

SOC 1: For financial reporting If you run processes that affect your customer’s financial statements, SOC 1 applies. Think of payroll services, billing platforms and transaction processing. SOC 1 tests whether your controls are correct, so your customer can rely on them for their financial reporting.

SOC 2: For IT security and operational controls This is the relevant one for SaaS, cloud providers and IT service providers. It tests whether your security, availability, confidentiality and other criteria are in order. This article is about SOC 2.

SOC 3: Public version of SOC 2 Same criteria as SOC 2, but a shortened version without sensitive details. You may share a SOC 3 publicly (no NDA needed). It has less detail, so enterprise procurement teams often don’t accept it. It is better suited to marketing purposes.

For tech companies, SOC 2 is what you need. Unless you are a fintech that also processes transactions, in which case you may need SOC 1 + SOC 2.

How much does SOC 2 cost?

It depends on company size, complexity, Type I vs Type II, and the criteria you choose. Indications:

Small company (1-25 people):

• Type I: €15,000-€30,000 audit + €8,000-€15,000 consultancy + €5,000-€12,000 tooling = €28,000-€57,000 total in year one
• Type II: €30,000-€50,000 audit + €8,000-€15,000 consultancy + €5,000-€12,000 tooling = €43,000-€77,000 total in year one

Medium-sized company (25-100 people):

• Type II: €45,000-€80,000 audit + €15,000-€30,000 consultancy + €10,000-€20,000 tooling = €70,000-€130,000 total in year one

Large company (100+ people):

• Type II: €70,000-€150,000+ audit + €15,000-€50,000 consultancy + €15,000-€40,000 tooling = €100,000-€240,000+ total in year one

Don’t forget internal costs: 200-500 hours of project management and 100-200 hours of IT work. At €75 per hour fully loaded, that is €20,000-€60,000 extra.

Detailed cost breakdown

How long does it take to get SOC 2?

Type I: 3-6 months

• 2-3 months of preparation (gap analysis, policies, implementation)
• 3-5 weeks of audit
• 1-2 weeks of reporting

Type II: 6-15 months

• 3-6 months of preparation
• 3-12 months of observation period (usually 6 months)
• 5-12 weeks of audit
• 2-4 weeks of reporting

The observation period cannot be shortened. Six months is six months. You can spend money to speed up preparation (by hiring consultants), but the observation period is tied to time.

Type I or Type II? Which should I choose?

Choose Type I if:

• You need SOC 2 for a deal within 3-6 months
• Your budget is limited and you want to spread the investment
• You want to “practise” first and test whether you are ready
• Your customers accept Type I as an interim step

Choose Type II if:

• You target enterprise customers (they almost always want Type II)
• You have 12+ months before you need it
• You want to show real assurance (not only design, but also operational effectiveness)
• You want to invest once, not pay twice

Most companies start with Type I to get a report quickly, and upgrade to Type II 6-12 months later.

Full comparison of Type I vs Type II

Which Trust Services Criteria should I choose?

Security: Mandatory, always.

Availability: Choose this if you have an SLA (99.9% uptime) or if downtime has a direct business impact on your customers.

Processing Integrity: Choose this if you process transactions, perform calculations, or handle financial data where accuracy is business-critical.

Confidentiality: Choose this if you process customers’ proprietary information (trade secrets, strategic data) or if customers have NDAs with you.

Privacy: Choose this if you process a lot of personal data (consumer apps, HR data, health data) and want to show GDPR compliance.

Typical: 75% choose Security + Availability. If you handle sensitive data, add Confidentiality. Only choose what is relevant, not “everything because we can.”

Detailed explanation of the Trust Services Criteria

Can I do SOC 2 myself without a consultant?

Yes, but it is not easy. Doing SOC 2 yourself requires:

• Someone with security or compliance experience (at least 3-5 years)
• Time (500-800 hours in total across the whole process)
• An understanding of the AICPA Trust Services Criteria
• Experience with audits (otherwise you don’t know what auditors want to see)

With compliance tooling (Vanta, Drata, Secureframe) it becomes easier:

• Automated evidence collection
• Policy templates
• Gap analysis
• Guidance through the process

Cost-benefit: a consultant costs €10,000-€30,000, but saves you 150-300 hours of struggling and reduces the chance of findings. For a first SOC 2, we strongly recommend hiring help, at least for the gap analysis and readiness assessment.

What happens if I fail the audit?

You get findings. These go into your report. Types of findings:

• Control deficiency: one control did not work properly
• Significant deficiency: several controls, or a serious weakness
• Material weakness: a major error with potentially serious impact

What happens next: You have time to remediate findings (depending on the type, 30-90 days). You write a management response: what went wrong, what you did, and when it was fixed. This goes into the report.

Clean vs qualified opinion:

• Clean (unqualified): “Controls are effective” → this is what you want
• Qualified: “Controls are effective, except for…” → findings included → not ideal, but acceptable if the findings are minor
• Adverse: “Controls are not effective” → very rare, and means serious problems

Re-audit: If the findings are serious, you can request a re-audit after remediation. This costs extra (€5,000-€15,000), but then you get a clean report.

Prevention: Do a readiness assessment 4-6 weeks before the official audit. Findings during the readiness assessment are not a problem. You fix them before the real audit starts.

How often do I need to renew SOC 2?

Annually. Your SOC 2 report is valid for the period that was audited. A Type II report covering January to December 2025 is “valid” until you have a new report for January to December 2026.

Customers don’t want to see a gap. If your report ends in December 2025 and it is now March 2026, you have a 3-month gap. Some customers accept that, others don’t.

Planning: Start the re-audit 3-4 months before your current report expires. The auditor visits, checks that your controls still work, and you receive a new report. The process is quicker than the first time (50-70% of the effort), because your system is already running.

Cost of a re-audit: 50-70% of your first audit. If the first audit cost €60,000, a re-audit costs €30,000-€42,000.

What is a SOC 2 bridge letter?

A bridge letter is a short statement that bridges the gap between your SOC 2 report and today. For example, your Type II report covers January to December 2025. If a customer asks for your report in March 2026, there is a gap of a few months. In the bridge letter (also called a gap letter), your management states that nothing material has changed in your controls since the report. It is not an audit and does not replace the report: an accountant does not sign it, you declare it yourself. Most customers accept a gap of up to 3 months with such a letter. Read the full explanation, including an example structure, on the page SOC 2 bridge letter.

Can I combine SOC 2 and ISO 27001?

Yes, and many companies do. 80% of the controls are the same. If you have one, the step to the other is much smaller.

From SOC 2 to ISO 27001: You already have operational controls. What you add: an ISMS (information security management system) framework with risk management, a Statement of Applicability, internal audits and management review. Estimate: 30-40% of the effort of your first SOC 2.

From ISO 27001 to SOC 2: You already have an ISMS and controls. What you add: evidence collection in the Trust Services Criteria (TSC) format, and evidence for the observation period. Estimate: 30-40% of the effort of your first ISO 27001.

Timing: One first, then the other. Not both at the same time, as that is too much work. Year 1: SOC 2 or ISO 27001. Year 2: add the other.

Full comparison of SOC 2 vs ISO 27001

Do I have to implement all 93 Annex A controls of ISO 27001?

You are thinking of ISO 27001. SOC 2 has no “93 controls.” SOC 2 has Trust Services Criteria with roughly 60-90 control requirements, depending on which criteria you choose.

For ISO 27001: no, you don’t have to implement all 93 Annex A controls. You carry out a risk assessment, decide which controls are relevant, and document in your Statement of Applicability (SoA) which ones you implement and which are not applicable.

For SOC 2: you must address all requirements of the criteria you choose. Security (mandatory) has roughly 60 requirements. If you add Availability, another 15-20 come with it, and so on.

Can I get SOC 2 without MFA?

Technically: the auditor tests whether your controls are adequate for your risk profile. If you have a very low-risk application (no sensitive data, no external users), you could theoretically argue that password-only access is sufficient.

In practice: no, MFA is de facto mandatory. Every auditor will ask, “Why no MFA?” Your answer must be watertight. In 2026, “we thought it was too expensive” is not an acceptable answer.

MFA is expected on at least:

• Production environment access (cloud consoles, servers)
• Code repositories (GitHub, GitLab)
• Admin accounts in your SaaS product
• Email (G Suite, Office 365)
• HR and payroll systems
• Any system with customer or production data

The cost of MFA is negligible (€0-€5 per user per month). There is no excuse for not having it.

Can I use the SOC 2 logo on my website?

No. There is no official “SOC 2 logo.” SOC 2 is a report, not a certificate. You must NOT say “we are SOC 2 certified,” because that is technically incorrect.

What you ARE allowed to say:

• “We have a SOC 2 Type II report”
• “SOC 2 Type II compliant”
• Make your own badge: “SOC 2 Type II Attested,” with a link to “request our report”
• On your security page: “SOC 2 Type II report available upon request”

What you must NOT do:

• Make a fake certificate that looks official
• Use the AICPA logo (it is a trademark of the AICPA)
• Say “certified” (it is a report, not a certification)

By contrast, ISO 27001 is a certificate, and you MAY use the ISO 27001 logo after certification.

What is the difference between ISAE 3000 and SOC 2?

This is confusing for Dutch companies. The simple answer:

• SOC 2 is the American standard from the AICPA
• ISAE 3000 is the international assurance standard from the IFAC

Dutch accountants use ISAE 3000 as a framework and carry out a SOC 2 audit with it, according to the AICPA criteria.

In practice: you get an “ISAE 3000 SOC 2 report” from a Dutch accountant. NOREA calls such a report a SOC 2 equivalent. To check whether your American customer accepts it as SOC 2, ask them in advance. See American customers and a Dutch auditor.

You don’t need to go to America to get a SOC 2 audit. Dutch firms can do it. Check whether they have experience with SOC 2, because not all accountants do.

NOREA  (the Dutch professional association) has published guidance on SOC 2 in the Netherlands.

What is the difference between ISAE 3402 and SOC 2?

In short: ISAE 3402 is about financial outsourcing, and SOC 2 is about security. ISAE 3402 tests controls that affect your customer’s financial reporting (think payroll or invoicing). That is the international counterpart of SOC 1. SOC 2 tests your IT security using the Trust Services Criteria and runs on the broader ISAE 3000 standard.

Don’t confuse ISAE 3402 with ISAE 3000: 3402 belongs to SOC 1, and 3000 belongs to SOC 2. Not sure which one your customers ask for? Read the full explanation in ISAE 3402 vs SOC 2.

Can a startup get SOC 2?

Yes. There is no minimum company size. Even a team of 5 people can get SOC 2. Read SOC 2 for startups and scale-ups for a detailed approach, including cost estimates by team size and tooling advice.

Practical points:

• Controls must fit your size. You don’t have a dedicated security team, but you can still have MFA, logging and basic procedures.
• Type I is more realistic for very small startups (faster and cheaper).
• Consultancy is strongly recommended. You have no experience, and a consultant guides you through the process.
• Compliance tooling is almost a must-have, otherwise you drown in manual work.

Costs for a 5-10 person startup: €30,000-€50,000 in total for Type I (audit + consultancy + tooling). Type II: €45,000-€70,000.

That is a lot for a pre-seed company. But if an enterprise deal worth €100,000 ARR is blocked by SOC 2, it pays for itself immediately.

Does my cloud provider (AWS/Azure/GCP) also need SOC 2?

Good question. Yes, but you don’t have to arrange it. AWS, Azure and GCP all have SOC 2 Type II reports. These are publicly available through their compliance portals.

What your auditor checks:

• Have you requested your cloud provider’s SOC 2 report?
• Is it recent (within 12 months)?
• Does it cover the services you use?
• Have you reviewed it? You must be able to show that you know what is in it.

This is vendor risk management. You are responsible for your supply chain. If AWS goes down because of its own security incident, that is your problem towards your customers.

For smaller vendors (for example an email provider, a monitoring tool or a CRM): ask for their SOC 2 or ISO 27001. If they don’t have one, do a risk assessment: how critical is this vendor, what data do they hold, and what is the risk? Document your decision.

What if I have a remote team in multiple countries?

No problem. SOC 2 focuses on your systems and data, not on where your people are.

What your auditor checks:

• How do you manage access for remote employees?
• Do you have device management (MDM) so company data is protected?
• Do you have a VPN for access to production?
• How do you handle remote onboarding and offboarding (for example, collecting the laptop when someone leaves)?
• Do you run background checks on remote employees?
• Data residency: where is your data stored (which AWS region)?

Tips:

• MDM (Mobile Device Management) such as Jamf or Kandji for Macs
• VPN required for production access
• A BYOD policy if people use their own devices
• Clear procedures for remote onboarding and offboarding
• Asset tracking: who has which laptop

Many SaaS companies are remote-first and have SOC 2. It is feasible.

How do I choose an auditor?

Criteria:

• Experience with SOC 2: How many audits do they do per year? Do they work with SaaS companies?
• Sector experience: Do they know your industry (fintech, healthcare, etc.)?
• Dutch vs American firms: Dutch firms can do ISAE 3000/SOC 2. American firms do pure SOC 2.
• Price: varies 2-3 times between firms (€15,000-€80,000+)
• Timing: can they meet your schedule?
• References: talk to their other clients

Well-known names:

• Big 4: Deloitte, PwC, EY, KPMG (more expensive, but with brand value)
• Dutch firms: Baker Tilly, Mazars, BDO, RSM
• US-focused: A-LIGN, Schellman, Prescient Assurance, Sensiba
• Budget: TrustCloud, ConductorCPA (online and cheaper)

Advice: Get at least 3 quotes. Don’t just check the price, but also the “chemistry.” You will work closely together for 3-6 months. If the auditor is not responsive during the quotation stage, it won’t get better during the audit.

Can I expand my scope later?

Yes. You start with Security only. Next year, you add Availability. The year after, you add Confidentiality.

Process: At re-audit, tell the auditor which criteria you want to add. They test those new criteria in full, as if it were the first time. Your existing criteria are re-audited, which is a lighter process.

Cost: An additional criterion adds 15-25% on top of the re-audit cost. If the re-audit costs €40,000, adding Availability brings it to €46,000-€50,000.

Timing: No extra lead time if you are prepared. The auditor simply tests more controls.

In practice, start small (Security, or Security + Availability) and expand when customers ask for specific criteria.

What is a readiness assessment and do I need one?

A readiness assessment is a pre-audit. A consultant (or sometimes your auditor) runs a mini audit to check whether you are ready for the real one. A full explanation of how it differs from a gap analysis, when you can do it yourself, and what it delivers is on the page SOC 2 readiness assessment.

What gets tested:

• Are your policies complete and coherent?
• Are your controls implemented?
• Is your evidence collected and organised?
• Which gaps still need to be closed?

Output: A report with findings and recommendations. You have time to fix things before the official audit.

Costs: €2,000-€8,000, depending on scope.

Do you need it? Not mandatory, but strongly recommended. It prevents you from getting findings during the official audit that end up in your report. Readiness findings are private. Official audit findings are in the report that your customers see.

70% of companies that skip the readiness assessment get unexpected findings during the audit. That €5,000 readiness assessment would have saved a lot of stress.

Any more questions?

Can’t find your question here? Email info@normwijzer.nl or check these pages:

• What is SOC 2: Complete introduction
• Step-by-step plan: 12 steps from zero to report
• Costs and timeline: Detailed breakdown
• The audit process: What the auditor does exactly
• Trust Services Criteria: The 5 pillars explained