Published · By the Aesparrow Security Research Team
Short answer
SOC 2 is an AICPA attestation that reports on a service organisation’s controls against the Trust Services Criteria — Security, plus optionally Availability, Processing Integrity, Confidentiality and Privacy. A Type 1 report assesses control design at a point in time; a Type 2 report tests operating effectiveness over a period, typically three to twelve months.
SOC 2 readiness checklist
- Choose criteria and scope: Security plus any additional Trust Services Criteria.
- Policies: information security, access, change, incident, vendor and more.
- Access control: SSO, MFA, least privilege and quarterly access reviews.
- Change management: peer review, testing and approvals.
- Monitoring: logging, alerting and vulnerability scanning.
- Penetration test: independent test with remediation evidence.
- Vendor management: risk assessments of critical suppliers.
- HR security: background checks, onboarding and training.
- Business continuity: backups and tested recovery plans.
What drives SOC 2 readiness cost?
Scope, the number of Trust Services Criteria, existing controls and tooling, and whether you pursue Type 1 first or go straight to Type 2. Auditor (CPA firm) fees are separate from readiness consulting.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
Should a startup start with SOC 2 Type 1 or Type 2?
Many startups start with Type 1 to unblock deals quickly, then move to Type 2 once controls have operated for the observation period.
Who issues a SOC 2 report?
An independent CPA firm. Readiness consultants help you prepare but do not issue the report.