SOC 2 compliance: What it is and why your app needs it
- Riya Thambiraj
- Buyer's Playbook
- Last updated on
Key Takeaways
SOC 2 isn't a law - it's an audit standard, but enterprise customers treat it as a requirement for vendor selection
Type I confirms your controls exist; Type II confirms they work over time - enterprise customers want Type II
The five Trust Service Criteria are Security (mandatory), Availability, Processing Integrity, Confidentiality, and Privacy (choose what applies)
Plan for 6-12 months from starting SOC 2 prep to receiving your Type II report
Building SOC 2 controls into your app from day one costs 10-15% extra; retrofitting an existing product takes 3-6 months of dedicated work
A B2B SaaS startup spent 18 months building a product, signed up 40 small customers, and then landed a meeting with a Fortune 500 prospect. The deal was worth more than all existing customers combined.
Three weeks into the procurement process, the prospect's security team asked for a SOC 2 Type II report. The startup didn't have one. Didn't even have a Type I. The prospect said they'd revisit in 6-12 months - after the startup completed the SOC 2 process.
That deal didn't close for another year. And it's not an unusual story. In B2B SaaS, SOC 2 is the minimum bar for enterprise sales. If you don't have it when the prospect asks, you lose months of sales momentum.
The financial stakes are real on both sides. IBM's 2024 Cost of a Data Breach Report found the average breach now costs $4.88 million - a 10% jump from the prior year and the largest single-year increase since the pandemic. SOC 2 controls exist to prevent exactly these incidents.
TL;DR
SOC 2 is an auditing standard that proves your app protects customer data. It's not legally required, but it's practically mandatory for B2B sales - most enterprise procurement teams won't sign a contract without a SOC 2 Type II report. The process covers five Trust Service Criteria (Security is mandatory, then choose from Availability, Processing Integrity, Confidentiality, and Privacy). Plan for 6-12 months and $50K-$200K from start to report. Building SOC 2 controls into your product from day one saves months compared to retrofitting.
What SOC 2 actually is
SOC 2 is an auditing framework, not a certification. An independent CPA firm examines your security controls and issues a report on whether they meet the AICPA's Trust Service Criteria. The report is your proof to customers that you take data protection seriously.
What it's not: SOC 2 isn't a government regulation. Nobody will fine you for not having one. But in the B2B world, it functions as a de facto requirement. Enterprise security teams use it as a filter - no SOC 2, no contract.
The buyer data backs this up. Gartner Digital Markets' 2024 buying trends survey - covering 3,484 respondents across 9 countries - found that 46% of software buyers rank security certifications and data privacy practices as their top reason for selecting a vendor, essentially tied with price (48%). The same research found 45% of businesses had stopped using a software platform because of security concerns.
The two types:
Type I - Examines whether your controls are properly designed at a specific point in time. Think of it as a snapshot: "On March 15, 2026, these controls existed and were properly designed." Faster to get (2-3 months), but carries less weight with buyers.
Type II - Examines whether your controls operated effectively over a period (typically 3-12 months). This is the one enterprise customers want. It proves your security isn't just designed well - it actually works day in, day out.
Most companies get a Type I first (to demonstrate commitment while the observation period runs), then transition to Type II. Some skip Type I entirely and go straight to Type II if they can handle a longer timeline.
The five trust service criteria
SOC 2 is organized around five categories called Trust Service Criteria. Security is mandatory. The other four are optional - choose based on what your customers care about.
Security (common criteria) - mandatory
Protection of information and systems against unauthorized access. This is the foundation of every SOC 2 audit.
What it covers:
Access controls (who can access what, and how is that enforced?)
Network security (firewalls, intrusion detection, network monitoring)
Change management (how are code and infrastructure changes controlled?)
Risk assessment (how do you identify and manage security risks?)
Incident response (what happens when something goes wrong?)
Vendor management (how do you vet and monitor third-party services?)
Employee security (background checks, training, offboarding)
Availability - recommended for SaaS
Your system is available for operation and use as committed. If you have uptime SLAs with customers, include this.
What it covers:
Uptime monitoring and SLAs
Disaster recovery and business continuity planning
Capacity planning
Backup and restore procedures
Incident management for availability events
Processing integrity - recommended for data/finance apps
System processing is complete, valid, accurate, timely, and authorized. Include this if your app processes transactions, calculations, or data transformations.
What it covers:
Data processing accuracy and completeness
Error detection and correction
Input/output validation
Processing monitoring
Confidentiality - recommended when handling sensitive business data
Information designated as confidential is protected. Include this if you handle trade secrets, financial data, or other business-sensitive information.
What it covers:
Data classification
Encryption of confidential data
Access restrictions to confidential information
Secure data disposal
Privacy - recommended when handling personal information
Personal information is collected, used, retained, disclosed, and disposed of properly. Similar to GDPR requirements. Include this if you handle end-user personal data.
What it covers:
Notice and consent for data collection
Data subject access and correction rights
Data retention and disposal
Disclosure and sharing controls
Most B2B SaaS companies start with: Security + Availability. Add the others as your customer base and product mature.
The five criteria map neatly to what enterprise security teams actually test. Security and Availability cover more than 80% of the questions in a typical enterprise vendor questionnaire - which is why most B2B SaaS companies start there before expanding to the others.
What SOC 2 controls look like in practice
SOC 2 doesn't prescribe specific technologies. It defines objectives, and you choose how to meet them. Here's what typical controls look like for a SaaS app:
Access controls
Single sign-on (SSO) for all internal tools
MFA required for all employees
Role-based access with least-privilege principle
Quarterly access reviews (verify people still need their access)
Immediate access revocation when employees leave
Change management
All code changes require pull request reviews
No direct commits to production branches
Automated CI/CD pipelines with security checks
Infrastructure changes tracked in version control (IaC)
Change approval records maintained
Monitoring and logging
Centralized log collection (all application and infrastructure logs)
Automated alerting on security events
Log retention for 12+ months
Regular log review (can be automated)
Incident response
Documented incident response plan
Defined severity levels and escalation paths
Post-incident review process
Customer notification procedures for security incidents
Vendor management
Security assessment of all third-party vendors
Annual vendor reviews
Data processing agreements in place
Vendor SOC 2 reports collected and reviewed
Employee security
Background checks for new hires
Security awareness training (annual minimum)
Acceptable use policies
Clean desk / screen lock policies
The SOC 2 timeline
| Phase | Duration | What Happens |
|---|---|---|
| Gap assessment | 2-4 weeks | Audit current controls against SOC 2 requirements, identify gaps |
| Remediation | 1-3 months | Implement missing controls, set up compliance tooling, write policies |
| Type I audit (optional) | 2-4 weeks | Auditor examines controls at a point in time |
| Observation period | 3-6 months (minimum 3) | Controls operate and are monitored. Evidence is collected continuously. |
| Type II audit | 4-6 weeks | Auditor reviews evidence from the observation period, tests controls |
| Report delivery | 2-4 weeks | Auditor writes and delivers the SOC 2 Type II report |
Total: 6-12 months from start to Type II report.
If your app was built with SOC 2 controls from the beginning (access controls, logging, change management baked into the development process), the remediation phase shrinks significantly and the observation period can start sooner.
How SOC 2 affects your app architecture
| SOC 2 Requirement | Architecture Impact |
|---|---|
| Access controls | SSO integration, RBAC at the application level, session management, MFA support |
| Audit logging | Centralized logging pipeline, structured log format, 12-month retention |
| Encryption | Data encrypted at rest (AES-256) and in transit (TLS 1.2+) |
| Change management | CI/CD pipeline with code review gates, no manual production deployments |
| Monitoring | Application performance monitoring, error tracking, security event alerting |
| Data backup | Automated backups, tested restore procedures, defined RPO/RTO |
| Incident response | Alerting system, on-call rotation, status page for customer communication |
Compliance automation tools
Most companies use a compliance automation platform to manage SOC 2 evidence collection. These tools integrate with your infrastructure and continuously collect evidence that your controls are operating.
Popular options:
Vanta - Integrates with AWS, GCP, Azure, GitHub, Jira, HR systems. Automates ~80% of evidence collection.
Drata - Similar coverage. Good for companies needing multiple frameworks (SOC 2 + ISO 27001 + HIPAA).
Secureframe - Focuses on speed to audit. Good onboarding experience.
These tools typically cost $10K-$30K/year, but they dramatically reduce the manual effort of collecting evidence and preparing for audits. Without them, you're managing spreadsheets and screenshots - which doesn't scale.
What SOC 2 costs
| Component | Cost Range | Notes |
|---|---|---|
| Compliance automation platform | $10K-$30K/year | Vanta, Drata, or Secureframe |
| Remediation (implementing controls) | $20K-$100K+ | Depends on gap size. Building from scratch costs more than fixing gaps. |
| Auditor fees (Type II) | $20K-$80K | Depends on scope and auditor. Big 4 firms charge more. |
| Penetration test | $5K-$20K | Required annually by most auditors |
| Ongoing maintenance | $15K-$40K/year | Tool subscriptions, annual audit, policy updates |
Year 1 total: $50K-$200K+. Subsequent years: $30K-$80K (less remediation, same tooling and audit costs).
The ROI calculation: if SOC 2 unlocks one enterprise deal worth $100K+ ARR, it pays for itself. Most B2B SaaS companies find that SOC 2 removes the biggest objection in enterprise sales cycles.
"We've seen founders stall a $300K deal for six months because they didn't have SOC 2 in place. The audit cost them $80K. The delay cost them far more in momentum and team distraction. Start SOC 2 prep the same quarter you decide to go upmarket - don't wait for a prospect to ask."
Ashit Vora, Captain at RaftLabs
How SOC 2 affects your architecture decisions in practice
"The teams that struggle most with SOC 2 are the ones who treat it as a documentation exercise after the fact. The ones who sail through the audit are the ones who built logging, access controls, and CI/CD gates into the product from day one - not because of SOC 2, but because those are just good engineering practices."
RaftLabs Engineering Team
Questions to ask your development partner
-
"Do you build apps with SOC 2 controls from the start?" - Look for: CI/CD with code review gates, centralized logging, RBAC, encryption at rest and in transit, automated backups. These should be standard practice, not add-ons.
-
"How do you handle change management in your development process?" - SOC 2 requires documented change management. Your partner should use pull requests, code reviews, and no-direct-commit policies as standard practice.
-
"What logging and monitoring do you include?" - Centralized logging and monitoring should be in the base architecture, not bolted on later. Ask about structured logging, log retention, and alerting.
-
"Have you worked with SOC 2 compliance platforms?" - Experience with Vanta, Drata, or similar tools means they understand what auditors look for and can build evidence-friendly controls.
-
"Can your architecture support a SOC 2 observation period from day one?" - If controls are in place from the first deployment, your observation period can start immediately after launch - shaving months off the timeline.
Your SOC 2 readiness checklist
Before development starts
- ✓Decide which Trust Service Criteria to include— Security is mandatory; add Availability, Processing Integrity, Confidentiality, Privacy as needed
- ✓Choose a compliance automation platform— Vanta, Drata, Secureframe
- ✓Select an audit firm (get proposals from 2-3 firms)
- ✓Set your target timeline for Type II report
During development (build these in from day one)
- ✓Implement SSO and MFA for all internal access
- ✓Implement RBAC at the application level
- ✓Set up centralized logging with 12+ month retention
- ✓Implement encryption at rest (AES-256) and in transit (TLS 1.2+)
- ✓Set up CI/CD with mandatory code reviews (no direct commits)
- ✓Set up infrastructure as code (all infra changes version-controlled)
- ✓Implement automated backups with tested restore procedures
- ✓Set up application monitoring and security alerting
Before the observation period
- ✓Document all security policies— Access management, incident response, change management, vendor management, acceptable use
- ✓Complete employee security training
- ✓Run a penetration test and remediate findings
- ✓Complete a risk assessment
- ✓Connect all systems to your compliance automation platform
- ✓Verify evidence is flowing correctly
During the observation period
- ✓Maintain all controls consistently— This is what the auditor evaluates
- ✓Conduct quarterly access reviews
- ✓Respond to and document any security incidents
- ✓Collect evidence of control operation— Mostly automated by your platform
SOC 2 is a repeating cycle - the report covers a specific period, and enterprise customers expect you to renew annually. The first year is the hardest. After that, it's maintenance and continuous improvement.
Frequently Asked Questions
SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA (American Institute of Certified Public Accountants). It evaluates how a company protects customer data across five criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. A SOC 2 report is issued by an independent CPA firm after auditing your controls. It's the most commonly requested security certification in B2B SaaS sales.
Type I evaluates whether your security controls are properly designed at a specific point in time. Type II evaluates whether those controls operated effectively over a period of time (typically 3, 6, or 12 months). Type I is faster and cheaper (a starting point), but enterprise customers almost always want Type II because it proves your controls work consistently, not just on audit day.
From zero to Type II report: 6-12 months. Typical timeline: 1-3 months to assess gaps and implement controls, 3-6 months observation period for Type II (your controls run and are monitored), 1-2 months for the audit itself. If your app was built with SOC 2 controls from the start, the observation period can begin earlier.
Total cost ranges from $50K to $200K+ depending on company size and current security maturity. Compliance automation tools (Vanta, Drata, Secureframe): $10K-$30K/year. Auditor fees: $20K-$80K for Type II. Remediation and control implementation: $20K-$100K+ depending on gaps. Ongoing annual costs: $30K-$80K for tool subscriptions, annual audit, and maintenance.
It depends on your market. US enterprise buyers typically ask for SOC 2. European and international buyers often prefer ISO 27001. There's significant overlap - about 70% of the controls map to each other. If you're selling globally, you may want both. Start with whichever your target customers request most.
Security (also called 'Common Criteria') is mandatory for every SOC 2 audit. Beyond that, choose based on your product: include Availability if you have uptime SLAs, Processing Integrity if you process transactions or calculations, Confidentiality if you handle sensitive business data, and Privacy if you handle personal information. Most B2B SaaS companies start with Security + Availability.
SOC 2 reports are 'restricted use' documents - they're intended for existing customers and prospects who need them for due diligence. You can share them under NDA. You shouldn't post them publicly. What you can do publicly is state that you have a current SOC 2 Type II report and display a SOC 2 badge on your website. Many companies use a 'trust center' page to share reports after NDA signing.
