SOC 2 Type II for SaaS, Without Stalling the Roadmap
Enterprise buyers ask for the report before they sign. We scope the audit, build the controls into how your team already ships, and run the evidence and auditor work so engineers stay on product.
Who this is for
B2B SaaS companies, typically Series A or B with 15–100 employees, facing an enterprise deal or security questionnaire that requires a SOC 2 report, and without a full-time security lead.
SOC 2 is an attestation report issued by an independent CPA firm on a service organization's controls, measured against the AICPA Trust Services Criteria. Security is always in scope; Availability, Processing Integrity, Confidentiality, and Privacy are added when relevant. A Type I report covers control design at a point in time; a Type II report covers whether the controls operated over a period, which is what most enterprise procurement teams require.
The moments SaaS companies start SOC 2
A large prospect's procurement team will not move to contract without a SOC 2 Type II report.
Each security questionnaire costs your team days because there is no report to attach.
You bought Vanta, Drata, or Secureframe, the dashboard shows dozens of failing tests, and nobody owns fixing them.
Your first Type II period is about to start and you are not sure the controls will hold for months.
A customer asked about your sub-service organizations and complementary user entity controls, and the terms were new to you.
How a SOC 2 audit works for a SaaS company
SOC 2 is not a checklist with a pass mark. You define the system in scope — usually the production application, its cloud infrastructure, and the people and processes that run it — and choose which Trust Services Criteria apply. The auditor then tests whether your controls meet those criteria. Most SaaS reports carve out sub-service organizations such as AWS or Google Cloud and rely on those providers' own reports, and they list complementary user entity controls that customers must operate themselves, such as managing their own users' access.
For a SaaS company, the controls that take real work are usually the same handful: production access limited and reviewed, changes reviewed before deployment, vulnerabilities found and fixed on a schedule, vendors assessed, backups tested, incidents handled and recorded, and joiners and leavers processed consistently. A compliance automation platform collects evidence for many of these, but it does not design or operate them. That gap — between a green dashboard and controls that survive fieldwork — is where most first audits run into trouble.
Timing is set by the observation period. The AICPA does not mandate a minimum length for a Type II period; it is agreed with your auditor, and first reports often cover a few months while renewals commonly cover twelve. Getting audit-ready usually takes a few months before the period starts, so a realistic timeline from kickoff to a first Type II report is measured in months. A Type II delivered in 30 days is not possible; offers like that are a Type I or a readiness letter.
What is in scope for a typical SaaS SOC 2
Production cloud
The AWS, Google Cloud, or Azure accounts that host the application and customer data, with their IAM, logging, and backup configuration.
Source control and CI/CD
GitHub or GitLab, branch protection, required reviews, and the deploy pipeline — the evidence base for change management.
Identity and laptops
Your identity provider (Google Workspace, Okta, or Entra ID), MFA enforcement, and the device-management tool that shows employee laptops are encrypted and patched.
Ticketing and HR systems
Jira or Linear for change and incident records, and your HR system for onboarding, offboarding, and background checks.
Customer-data tools
Support desks, CRMs, analytics, and AI services that receive customer data — each a vendor to assess and possibly a sub-processor to disclose.
Compliance automation
Vanta, Drata, or Secureframe connected to the systems above to pull evidence continuously; a spreadsheet can work for very small scopes.
What the SOC 2 program includes
Scope and criteria selection
System boundaries for the description, the Trust Services Criteria you need (Security plus any your customers require), and the sub-service organizations to carve out.
Gap assessment
Controls compared with how your environment actually runs rather than what the automation dashboard reports, with findings ranked by audit risk.
Policies that match practice
Information security, access control, change management, incident response, vendor management, and business continuity policies written to describe what your team really does.
Control remediation
MFA gaps, over-broad IAM, missing branch protection, untested backups, and offboarding gaps fixed by our engineers while your team reviews the changes.
Evidence automation
Your compliance platform connected and tuned, failing tests resolved or documented, and recurring tasks such as access reviews scheduled.
Auditor coordination
Shortlisting CPA firms that fit your stage, scoping the engagement, and handling evidence requests during fieldwork. You contract and pay the auditor directly, which keeps the report independent.
First 30 days
- Read-only access to your compliance platform and cloud environment.
- Scope defined: systems, criteria, and sub-service organizations.
- Controls assessed against the Trust Services Criteria for your actual stack.
- Three to six quick-win controls closed, such as written policies, audit logging, and MFA enforcement.
- A gap report and a Type I and Type II timeline your auditor can work from.
After month one
- Remaining controls implemented in priority order.
- Auditor selected and the Type I date or Type II period scheduled.
- Quarterly access reviews, vendor reviews, and risk assessment kept on schedule through the period.
- Exceptions handled when they occur rather than discovered during fieldwork.
- Security questionnaires answered from the report and a maintained answer library.
SOC 2 and the frameworks around it
AICPA Trust Services Criteria
The 2017 criteria with points of focus revised in 2022: common criteria CC1–CC9 for Security, plus optional Availability, Processing Integrity, Confidentiality, and Privacy.
AICPA: 2017 Trust Services Criteria (revised points of focus, 2022)SOC 2 description criteria
Rules for the system description that opens every SOC 2 report, including how sub-service organizations and complementary user entity controls are presented.
AICPA: 2018 SOC 2 Description CriteriaType I versus Type II
Type I gives an opinion on control design at a date; Type II on design and operating effectiveness over a period. Buyers often accept a Type I as a bridge, rarely as the final answer.
ISO/IEC 27001:2022
A certifiable management-system standard with 93 Annex A controls, more common with European buyers. Most SOC 2 controls carry over; ISO adds management-system requirements and a certification-body audit.
ISO: ISO/IEC 27001:2022SOC 2 program pricing
The SOC 2 Readiness Sprint is $5,000 fixed for 30 days. Carrying the program through the audit and observation period typically fits the Essential retainer ($3,500–$7,500 per month), or Professional ($8,000–$15,000 per month) when combined with managed cloud or DevOps. The CPA firm quotes and bills its audit fee directly; our SOC 2 cost calculator gives a first estimate.
SOC 2 questions from SaaS founders
How long does SOC 2 Type II take?
From kickoff, expect a few months to become audit-ready, then the observation period you agree with the auditor (often about three months for a first report), then several weeks for the report to be issued. Six months is a fast first cycle; nine to twelve is common for complex environments.
Do we need a Type I first?
Not necessarily. A Type I helps when a deal needs something soon. If no buyer is waiting, going straight to a Type II period can save an audit fee. Our Type I vs Type II guide walks through the decision.
Which Trust Services Criteria should we include?
Security is required. Add Availability if customers rely on uptime commitments, Confidentiality if you hold their confidential business data, and Processing Integrity or Privacy only when customers specifically ask. Each added category adds controls and audit cost.
Does Vanta or Drata get us SOC 2 on its own?
No. These platforms collect evidence and track tasks; they do not design controls, fix gaps, or manage the auditor. They work best with someone accountable for the program, which is the role we fill.
Can we pass without a full-time security hire?
Yes. Many SaaS companies get their first reports with a named internal owner, usually the CTO or a senior engineer, and an outside team doing the work. A full-time security lead becomes worthwhile as audits, customers, and frameworks multiply.
Does PlatOps perform the audit?
No. A SOC 2 report must be issued by an independent CPA firm. We prepare you and coordinate fieldwork, and we take no referral fees from audit firms.
Find out how far you are from a SOC 2 report
A 30-day readiness sprint gives you an honest gap report, the first controls fixed, and a timeline your auditor can work with.