SOC 2 cost: build a budget from real work and real quotes

•SOC 22 November 2026·8 min read

SOC 2 cost is the sum of several different jobs, not the price of a single certificate. A licensed CPA firm quotes for an independent report on a defined system and period. Your team pays for the work of designing and operating controls, correcting gaps and preparing evidence. Software and outside advisers may help, but neither replaces the CPA opinion or the underlying work. If you need a budget for a US SaaS company, ask for a scoped audit quote and build a second worksheet for everything your people must do.

Do not start with an online average and add a margin. A Type 1 report at a point in time and a Type 2 report covering control operation over a period are different engagements. Security alone and Security plus additional Trust Services Categories can require different work. The AICPA describes SOC as a suite of assurance services CPAs provide. The firm performing your engagement, rather than a software vendor, must tell you what it will test and what it will charge.

What goes into SOC 2 cost?

The first distinction is between an assurance fee and the cost of being ready for assurance. The CPA firm examines a described service and the controls selected to meet the applicable Trust Services Criteria. Your organisation defines that service, identifies the risks, operates the controls and makes management assertions. A security lead who spends weeks rebuilding access approvals is a real cost even if no purchase order records it. So is engineering time spent producing logs and fixing a failed cloud configuration.

The AICPA Trust Services Criteria organise the examination around categories such as Security, Availability, Confidentiality, Processing Integrity and Privacy. Within Security, CC6.1 concerns logical access security software, infrastructure and architectures. A team may already operate the necessary access controls, but it still needs evidence that the controls operated during the relevant period. Adding a category because it sounds impressive can add tests and owners without answering a buyer’s actual requirement. Ask the buyer which report scope it needs before you price the programme.

Record costs in the period when work occurs. A readiness sprint may need concentrated engineering and policy work. A Type 2 observation period needs recurring access reviews, change approvals and exception follow-up. After the first report, the work continues if customers expect a current report each year. A one-time “SOC 2 project” budget hides that operating cost.

What changes the CPA firm’s quote?

Give every prospective firm the same written scope brief. Name the legal entity, service, hosting environment, important suppliers, locations, teams, report type, criteria and desired period. Ask what evidence it expects, how it selects samples, whether travel is included and what happens if the system changes during the engagement. A quote that assumes one product and one cloud account cannot be compared fairly with a quote covering several products and subsidiaries.

• ScopeThe described systemThe services, people, infrastructure, data flows and service organisations inside the boundary.Write first
• CriteriaTrust Services CategoriesSecurity is the common starting point; other categories should follow a real buyer or risk requirement.Confirm
• TypePoint in time or periodType 1 and Type 2 answer different assurance questions and require different evidence.Buyer need
• ExceptionsKnown gaps and changesTell the firm about missing reviews, new systems and control failures before it prices the work.Disclose

Do not compare firms solely on the lowest first-year fee. Ask who will perform the work, what the report will cover, the expected timetable, how exceptions are handled and what a later period costs. A cheap engagement whose scope excludes the product a customer is buying may have little commercial value. Conversely, a broad scope that nobody requested creates work you must maintain.

How do Type 1 and Type 2 affect the budget?

A Type 1 report addresses the design of controls at a point in time. A Type 2 report also addresses whether controls operated over the period stated in the report. If the buyer asks for Type 2, a Type 1 report does not become equivalent because your readiness dashboard is green. Ask procurement whether it will accept a current Type 1 report with a dated plan for Type 2; only the buyer can make that commercial decision.

For Type 2, budget the control work across the observation period. An access review performed once at the end does not demonstrate that monthly or quarterly reviews happened on time. Keep the full population of changes, hires, departures and incidents so the CPA can select samples. When an exception appears, preserve the source record, the owner’s decision and the corrective action. A platform can help organise those records; it cannot recreate a missed review after the period ends.

A longer period can be valuable to an enterprise buyer, but it also requires more sustained operation and potentially more testing. The right period is a question for the buyer and the CPA firm, not a universal number in a marketing article. The separate SOC 2 Type 2 guide on this site explains the evidence calendar and sampling problem in detail.

Which internal costs do founders underestimate?

Start with people, not software. A founder or security lead must settle scope and risk decisions. Engineering owners need to configure and operate access, change, logging and backup controls. People operations needs reliable joiner and leaver records. Procurement or legal may need to review important vendors and contracts. Someone must collect evidence, check its period and approve it for the assessor. Write the owner and expected hours for each recurring task; do not bury all of it under “compliance”.

• One-time gaps: missing SSO enforcement, cloud settings, policy approvals or a change-review process that is not yet operating.
• Recurring work: access reviews, vulnerability handling, incident exercises, vendor follow-up and evidence quality checks.
• Assessment support: answering CPA requests, resolving sample questions and reviewing the system description and report draft.
• Customer work: security questionnaires, procurement calls and controlled sharing of the completed report.

Separate a gap that can be fixed now from a control that needs a history of operation. The former may be a one-time engineering task; the latter becomes a recurring duty. If the team cannot identify an owner for each, a software purchase will only display the omission more clearly. A carefully maintained register may be sufficient for a small, stable scope with trustworthy source exports.

How should you compare SOC 2 quotes?

Create a one-page request for proposal and send the same version to each CPA firm. Include the system boundary, selected criteria, Type 1 or Type 2, intended dates, headcount and important service organisations. Ask the firm to state its assumptions rather than merely return a fee. Then put every response into the same comparison table: coverage, period, audit work, expenses, out-of-scope items, milestones and next-period pricing.

1. Confirm the buyer’s exact wording and the service it needs covered.
2. Write the system boundary and known changes before requesting any quote.
3. Ask each firm to identify its report type, period, criteria, fee and exclusions in writing.
4. Add your internal labour, remediation, adviser and software lines to the same budget.
5. Ask the selected firm how it handles scope changes and a later report period before signature.

If a proposal uses the word “certification”, ask for the exact deliverable and issuer. The AICPA source linked below describes the CPA assurance service. The firm’s engagement letter should identify the work it will perform. Keep the written scope with your budget so a later change request can be understood instead of appearing as an unexplained fee.

Where does software belong in a SOC 2 budget?

A tool is worth paying for when it removes repeated collection and makes the evidence easier to inspect. Evidr’s published product pages describe evidence upload, AI-assisted review with confidence scoring, control mapping, expiry monitoring and scoped auditor access to approved records. Test those claims with one real control, including a deliberately missing record. If a reviewer cannot trace the control to a source, owner, period and decision, automation has not solved the problem.

Evidr’s published Growth plan is $499 a month billed annually, with higher tiers and separately metered AI usage on the pricing page. That is a software line in your budget, not an auditor fee or a promise that all preparation is included. Check the current plan gates and usage terms before making a purchase order. Add setup time, integration permissions, reviewer time, data export and the cost of any outside adviser you still need.

Evidr can reduce repeated evidence collection and make reviewed records easier to inspect. Management still operates each control and resolves a missing record. A qualified CPA firm sets its own examination fee, reaches its own opinion and issues the SOC 2 report. Test the platform with one real control before budgeting for the workflow it saves.

What does a defensible SOC 2 budget look like?

It is a worksheet whose numbers come from your own hours and written supplier quotes. Put the CPA fee in one row. Put control-owner hours and remediation in separate rows. Put software, outside advice, report sharing and next-period operation below them. Mark unquoted items as unquoted rather than filling them with an attractive market average. Record the assumptions beside each number so finance can see what will change if scope expands.

For each line, identify who can approve it and when it must be spent. A cloud configuration change may be required before the observation period begins. The CPA invoice may follow engagement milestones. A subscription may renew before the next report. That calendar matters to cash flow and to audit evidence. It also exposes the risk of promising a report date before control owners and the firm have agreed on a workable period.

The last question is whether this budget answers the customer request. If a buyer needs assurance for a named hosted service, its scope must include that service. If it wants a Type 2 report, budget sustained operation and a CPA examination of that period. If no buyer has specified scope, start with the smallest defensible system boundary and ask prospective firms to price that same boundary. The report will be the CPA’s work; the operating controls remain yours.