# SimpleAudit: Complete Product Reference > AI-powered SOC 2 compliance for startups. Get audit-ready through conversation, not spreadsheets. > Last updated: 2026-10-11 Website: https://simpleaudit.io --- ## Product Overview SimpleAudit is a B2B SaaS platform that helps startups, small companies, and mid-size teams (1-299 people) achieve SOC 2 compliance without dedicated compliance staff, expensive consultants, or enterprise-grade tools. The platform uses AI to do the compliance work: generating policies, identifying risks, discovering vendors, creating task plans, and tracking audit readiness, while the human reviews and approves. This is fundamentally different from enterprise platforms like Vanta, Drata, and Secureframe, which automate compliance monitoring but still require the user to do the compliance work themselves. ### Key Differentiators - **AI-native, not AI-assisted**: The AI generates your SOC 2 policies, identifies your risks, discovers your vendors, and builds your task plan through natural conversation. - **Conversation-first interface**: Start with a chat, not a dashboard full of empty integrations. - **Zero integrations required**: No endpoint agents, no weeks of technical setup. Sign up and start immediately. - **Built for non-compliance people**: Plain-English interface for startup founders and CTOs, not compliance professionals. - **Startup-friendly pricing**: From $40/mo (Starter, billed annually at $480). Essentials is $199/mo billed annually. Competitor prices appear in the Competitive Comparison section, each with its source and the date it was read. - **US data residency**: All data stored in Azure US regions (East US 2 / Central US). AI inference runs on Azure AI Foundry US Data Zone deployments and stays in the US, on every plan. - **SOC 2 depth over breadth**: Focused excellence on SOC 2 rather than spreading thin across 40+ frameworks. --- ## Quick Facts | Field | Value | |---|---| | Founded | 2026, Wisconsin, United States | | Headquarters | Wisconsin, US | | Primary framework | SOC 2 (Type 1 + Type 2) | | Infrastructure | Microsoft Azure (East US 2 / Central US regions) | | Data residency | United States only: data stored in Azure US regions; AI inference in the Azure US Data Zone | | Team-size sweet spot | 1-299 employees (Startup 1-25, Small company 26-150, Mid-size 151-299) | | Trial | 7 days on Essentials and Pro (14 days on the Partner plan), a 3-day trial on Starter, full platform access, no credit card required | | Pricing | Starter $480/yr billed annually only; Essentials live at $199/mo billed annually, $299/mo month-to-month (no annual commitment); Pro available today at $599/mo, or $399/mo billed annually; Partner $599/mo billed annually ($7,188/yr) or $899/mo month-to-month for compliance consultancies and vCISOs | | Evidence Vault storage | 30 GB | | Founder | Joe (LinkedIn: https://www.linkedin.com/in/joseph-widi/) | --- ## Founder Story > Built from real SOC 2 experience, not a textbook. I led SOC 2 at a prior company. I spent $24K on a vCISO before realizing the work was still on me, then 8 weeks turning what I learned into the core product. I brought on 2 design partners to keep me honest, and self-funded years of runway. SimpleAudit is the tool I wished existed when I started. ### Why I built SimpleAudit When the first enterprise prospect asked for a SOC 2 report, I had two options: hire a $15K+ consultant or buy a $10K+/year platform built for 500-person companies with dedicated security teams. Neither made sense. The platforms wanted me to connect dozens of integrations and install endpoint agents on every laptop before I could write a single policy. The consultants charged $10K-$15K just to tell me what I was missing. So I did it the hard way: wrote the policies, filled the spreadsheets, pieced together a program from public guides. It worked, but it took months, cost $24K in vCISO time, and the company-specific knowledge lived in my head, not in a system. SimpleAudit is the AI I wish I'd had. It generates policies from a conversation about your actual business, finds the risks an auditor will ask about, and tells you when you're ready. You review and approve. You don't need a compliance background to drive it. ### By the numbers - **$24K**: vCISO spend before building this - **8 weeks**: first commit to live product - **2 design partners**: keeping me honest - **0**: outside capital raised, self-funded Contact: joe@simpleaudit.io --- ## How It Works ### Step 1: Tell Us About Your Company The AI asks plain-English questions about your company: cloud providers, team size, tools, data types, industry, existing security practices. No forms to fill out, no compliance jargon. It also helps you pick your audit window, the stretch of time your auditor will watch how you operate before issuing the report. Most teams start with a 3-month window so they can show enterprise prospects a Type 2 attestation letter within a quarter. The AI walks you through Type 1 vs Type 2 in plain English. ### Step 2: Identify What Matters Most The same conversation feeds the Business Impact Analysis (BIA), which captures your critical business functions, their downtime tolerance, and the systems they depend on. It is required input for SOC 2 Availability scoping. ### Step 3: Review AI-Generated Policies Based on your answers, the AI generates SOC 2 policies customized to your actual business. Review each policy in a rich text editor, make adjustments, and approve through built-in workflows. ### Step 4: Close the Gaps The AI analyzes your company against SOC 2 Trust Services Criteria and identifies gaps by priority (critical, high, medium). It then generates a prioritized task plan, identifies vendors to review, suggests risks to track, and tells you what evidence to collect. Tasks cross-link to policies, risks, and controls so nothing falls through the cracks. ### Step 5: Know When You're Ready Real-time readiness scoring across 6 compliance areas (policies, risks, vendors, evidence, access reviews, tasks). Watch your scores climb as you complete work. Know exactly when you are ready for your auditor. --- ## Features ### AI Policy Builder Generate SOC 2 policies through a guided AI conversation. The AI asks about your company, tools, and processes, then drafts policies customized to your business. **Capabilities:** - Conversational policy generation: no templates to fill out - Rich text editor for review and refinement - Full version history with rollback - Approval workflows (draft → in review → approved) - Section-level confidence scoring - PDF export for auditor deliverables - Cross-policy consistency checking **How it works:** 1. Tell the AI about your company, tech stack, and how your team works 2. Review AI-drafted policies in the rich text editor 3. Route through approval workflow and export for your auditor > Bottom line: SimpleAudit writes your SOC 2 policies from a conversation about how your business actually works, not from a generic template you'd have to rewrite anyway. ### Risk Register Identify and assess risks with AI-powered suggestions based on your company profile. **Capabilities:** - AI risk identification based on company profile and industry - 5x5 color-coded risk matrix (likelihood × impact) - Mitigation strategy tracking with owner assignment - Status tracking (Identified → Under Review → Mitigated → Accepted → Monitoring) - Excel export for auditor review - Bulk operations **How it works:** 1. AI suggests risks based on your company profile 2. Assess likelihood and impact on the 5x5 matrix 3. Document mitigations, assign owners, track progress > Bottom line: The AI proposes the risks auditors will actually ask about based on your tech stack and industry, so you start with a real risk register instead of an empty 5x5 grid. ### Vendor Management Track vendor risk with AI-powered discovery and security questionnaires. **Capabilities:** - AI vendor discovery from company profile and tech stack - Risk-level classification (Critical / High / Medium / Low) - Security questionnaire creation and management - Vendor portal with OTP verification for secure responses - Document gap alerts and expiration tracking - Follow-up assessment chains - Assessment template library **How it works:** 1. AI identifies vendors from your tech stack 2. Classify each vendor by risk level 3. Send security questionnaires, track responses, manage documentation > Bottom line: SimpleAudit identifies your vendors from your stack, classifies them by risk, and sends security questionnaires with OTP-verified vendor responses, with no manual vendor inventory required. ### Evidence Vault Version-controlled storage with full audit trail for compliance evidence. **Capabilities:** - Version-controlled file uploads with audit trail - Organization by SOC 2 control area - Custom tagging and full-text search - Evidence requirement tracking with lifecycle management (Active → Expiring → Expired → Renewed) - Staleness detection and expiration alerts - Control coverage analysis - One-click export **How it works:** 1. Upload evidence files, tag by control area 2. Evidence organized automatically by SOC 2 controls 3. Export organized evidence packages for your auditor > Bottom line: Upload once, tag by control, export an auditor-ready evidence package. Versioning and audit trail are automatic. ### Business Impact Analysis (BIA) Capture critical business functions, their downtime tolerance (RTO), data-loss tolerance (RPO), and the systems and vendors each function depends on. Required input for SOC 2 Availability scoping and audit-ready continuity planning. **Capabilities:** - Conversational function discovery: the AI extracts critical functions from your earlier discovery conversation - RTO / RPO scoring per function with tolerance bands (Tier 1 / Tier 2 / Tier 3) - System dependency mapping (function → systems → vendors) - Impact-area scoring (financial, operational, regulatory, reputational) - Workbench view with function-level, system-level, and vendor-level cards - Export for auditor review **How it works:** 1. The AI surfaces your critical business functions from the discovery conversation 2. Score each function's RTO, RPO, and impact across business dimensions 3. Map dependent systems and vendors; gaps surface as tasks in your remediation plan > Bottom line: BIA is the work most startups skip because it's tedious. SimpleAudit pre-fills it from your existing answers and lets you score in minutes, not days. ### Access Reviews Application registry with scheduled reviews and AI-powered discovery. **Capabilities:** - AI application discovery from company profile - Access type classification (Privileged vs Standard) - Scheduled recurring reviews with calendar invites - Access decision audit trail - Bulk calendar operations **How it works:** 1. AI identifies your applications 2. Schedule review frequency per application 3. Document access decisions with full audit trail > Bottom line: The AI discovers your applications, schedules recurring reviews, and captures access decisions with full audit trail, so quarterly access reviews stop being a fire drill. ### Task Management AI-generated task plans with cross-feature integration. **Capabilities:** - AI task generation from compliance gaps - Priority levels (Low / Medium / High / Critical) - Cross-linking to policies, risks, vendors, and controls - Recurring actions (monthly / quarterly / semi-annually / annually) - Task breakdown (parent → sub-tasks) - Calendar invite integration **How it works:** 1. AI identifies gaps and generates a prioritized task plan 2. Assign tasks, set due dates, track progress 3. Readiness score updates as tasks complete > Bottom line: Every gap becomes a prioritized task with a cross-link to the policy, risk, or vendor it relates to, so your remediation plan is a real plan, not a to-do list. ### Journey Readiness Real-time compliance readiness tracking across 6 areas. **Capabilities:** - Six-area dashboard: policies, risks, vendors, evidence, access reviews, tasks - Real-time progress percentages - Gap identification and prioritized recommendations - Audit period tracking with countdown - AI recommendations with urgency/effort/impact scoring **How it works:** 1. Dashboard shows readiness across all six areas 2. Click into any area to see what's missing 3. When all areas reach targets, you're audit-ready > Bottom line: Six readiness scores across all SOC 2 areas update in real time as you work, so you stop guessing when you're audit-ready. ### Evidence Push for AI Agents: MCP Connector & API (Pro) Programmatic evidence ingestion: your AI agents and scripts push evidence straight into the Evidence Vault. **Capabilities:** - MCP (Model Context Protocol) connector: point an AI agent (Claude, ChatGPT, or your own) at SimpleAudit and it can file evidence directly - REST API for scripts, CI pipelines, and scheduled jobs - Agentless by design: SimpleAudit never connects to your infrastructure, so there are no integrations to wire up, no read access to grant, and nothing to audit about SimpleAudit's own access - Pushed evidence lands version-controlled with a full audit trail, auto-tagged, and mapped to the right SOC 2 controls **How it works:** 1. Generate a company-scoped token in SimpleAudit 2. Connect your agent via the MCP connector (or call the REST API) 3. Evidence your agents collect lands in the vault, classified and control-mapped > Bottom line: The evidence-collection integrations enterprise GRC platforms sell as their moat become a push endpoint. Your own agents do the collecting, and SimpleAudit never touches your systems. ### AI Three-Way Reconciliation (Pro) Continuous reconciliation of your policies, your evidence, and the SOC 2 standard against each other. **Capabilities:** - Detects drift between what your policies promise, what your evidence proves, and what SOC 2 requires - Flags gaps with plain-language explanations (e.g. a policy promises quarterly access reviews, but no review evidence exists this quarter) - Creates the remediation task, cross-linked to the policy, control, and evidence involved - Watches continuously between audits, not just at audit prep time **How it works:** 1. The AI reads your approved policies, your vault evidence, and the SOC 2 criteria 2. Any two disagreeing produces a flagged gap with a recommended fix 3. Gaps become prioritized tasks; closing them restores reconciliation > Bottom line: Most teams discover policy-evidence drift during the audit, when it's a finding. Three-way reconciliation surfaces it the week it happens, when it's a ten-minute task. ### AI Tabletop Exercises (Pro) Guided incident response, disaster recovery, and business continuity exercises with evidence captured as you go. **Capabilities:** - AI-facilitated tabletop sessions for incident response, disaster recovery, and business continuity plans - Scenario walkthroughs run against YOUR documented plans, not generic scripts - Findings and gaps captured as remediation tasks - The exercise record auditors expect is generated automatically as evidence **How it works:** 1. Pick the plan to exercise (IR, DR, or BCP) and a scenario 2. The AI facilitates the session: your team walks the timeline and makes the calls 3. Debrief, gaps, and the evidence record land in the vault > Bottom line: Tabletop exercises are traditionally $8,000-$10,000 consultant engagements per exercise. In SimpleAudit they're included in Pro: run the exercise, capture the evidence, done. --- ## Pricing From $40/mo (Starter, billed annually at $480). Essentials is $199/mo billed annually. SimpleAudit's live plan today is Essentials, with Pro available today, and a Partner plan for compliance consultancies and vCISOs. Starter is the entry plan for a small team's first audit. The latest prices are on https://simpleaudit.io/pricing ### Starter: $480/year, billed annually only Gets a small team audit-ready for its first SOC 2 audit: Security criteria, 1 user. 3-day free trial, no credit card required. The $480 is always credited toward the first year of Essentials, billed annually. ### Essentials: $199/month billed annually ($2,388/year), or $299/month month-to-month The live plan today: full platform access, every feature included. Annual billing unlocks the lower monthly rate; the month-to-month option has no annual commitment, so you can ship one audit and re-evaluate without paying for a year up front. Includes: - AI Policy Builder - Risk Register - Vendor Management with security questionnaires - Evidence Vault - Access Reviews - Business Impact Analysis (BIA) - Task Management - Journey Readiness scoring - Trust Center: a public security page for buyers, with documents shared only when you approve ### Pro Pro is available today at $599/month, or $399/month billed annually ($4,788/year). It keeps you audit-ready automatically: AI three-way reconciliation (policies vs evidence vs the SOC 2 standard, with drift watching between audits), AI evidence auto-tagging and control mapping, programmatic evidence push from your AI agents (MCP connector / REST API: SimpleAudit never connects to your systems), and AI tabletop exercises for incident response, disaster recovery, and business continuity. Pro also includes custom branding throughout the portal, AI answers to customer security questionnaires (Coming soon) and AI contract review (Coming soon). See the pricing page (https://simpleaudit.io/pricing) for the latest details. ### Partner: $599/month billed annually ($7,188/year), or $899/month month-to-month For compliance consultancies and vCISOs managing client compliance at scale. Resell client subscriptions at wholesale rates (about 40% below retail), deliver a co-branded partner experience, and bring your own action plans and points of focus. Partners get everything in Pro, plus new features as they launch. 14-day free trial, no credit card required. ### Free Trial 7 days on Essentials and Pro, 14 days on the Partner plan, and a 3-day trial on Starter. Full platform access, no credit card required. > Bottom line: Essentials is available month-to-month with no annual commitment. If you want SOC 2 without a yearlong contract, you can start today and re-evaluate any month. --- ## Competitive Comparison Every competitor figure below is quoted from a public source, with the source and the date we read it. The CPA audit is a separate purchase on every platform. ### SimpleAudit vs Vanta Teams switch to SimpleAudit when they need SOC 2 compliance but cannot justify the cost or complexity of Vanta at their current stage. Vanta is quote-based, and Vendr's buyer data puts small companies at $12,000–$28,000 a year. SimpleAudit is from $40/mo (Starter, billed annually at $480). Essentials is $199/mo billed annually. No integration setup, no enterprise contract. **First-year platform cost:** $12,000–$28,000 + your auditor's fee. Vanta's range is Vendr's buyer data for companies with 1 to 50 employees on one framework (read 2026-09-29). Vanta publishes no prices. **Sourced figures:** - price small: $12,000–$28,000 (Vendr buyer data: Vanta, companies with 1–50 employees, one framework, read 2026-09-29) - price median: $20,000 (Vendr buyer data: Vanta, median across company sizes, read 2026-09-29) - pricing page: Four tiers (Essentials, Plus, Professional, Enterprise), no prices, demo only (Vanta pricing page, read 2026-09-29) - integrations: 400+ (Vanta website, read 2026-09-29) - agent: Vanta Agent (July 2026) (Vanta announcement of Vanta Agent, launched 2026-07-23, read 2026-09-29) **When Vanta is the better choice:** Vanta is right for a company that wants automated, continuous evidence collection and has someone to own it: an engineer or security lead who will connect and maintain its integrations (Vanta lists 400+). It is also the safer pick if you need several frameworks now, since SimpleAudit covers SOC 2 only, or if your buyers want a vendor name they already recognize. That is usually a team at Series A and beyond. For a small team that needs its first SOC 2 report, the bottom of Vendr's small-company range for Vanta, $12,000 a year, is more than a year of SimpleAudit Essentials plus a security-only Type 2 audit ($9,888). Full comparison: https://simpleaudit.io/compare/vanta-alternative ### SimpleAudit vs Drata Teams choose SimpleAudit over Drata when they want AI to do the compliance work, not just monitor the compliance infrastructure they build themselves. Drata automates compliance monitoring. SimpleAudit uses AI to do the compliance work for you, from policy generation to risk assessment. **First-year platform cost:** $12,000–$28,000 + your auditor's fee. Drata's range is Vendr's buyer data for companies under 50 employees on SOC 2 (read 2026-09-29). Drata publishes no prices. **Sourced figures:** - price small: $12,000–$28,000 (Vendr buyer data: Drata, companies under 50 employees, SOC 2, read 2026-09-29) - pricing page: Pricing page has demo/get-started only (Drata pricing page, read 2026-09-29) - integrations: 200+ (Drata website, read 2026-09-29) - releases 2026: AI for questionnaires, vendor risk and control mapping (Drata news and release notes (releasebot.io/updates/drata), releases 2026-09-02/09/16/18, read 2026-09-29) **When Drata is the better choice:** Drata is right for a team that already has a security or GRC owner and wants continuous control monitoring across many connected systems (Drata lists 200+ integrations), with room to add frameworks beyond SOC 2. Its 2026 releases, AI agent governance, agentic vendor risk and questionnaire automation, are built for that buyer, usually a company at Series A scale or later. If no one on your team will own integrations and you need one SOC 2 report, Drata's price buys capability you will not use yet: Vendr's buyer data puts companies under 50 employees at $12,000–$28,000 a year before the audit. Full comparison: https://simpleaudit.io/compare/drata-alternative ### SimpleAudit vs Secureframe Teams choose SimpleAudit when they want a SOC 2-focused tool that generates their compliance program through AI, not templates. Secureframe streamlines compliance workflows. SimpleAudit uses AI to generate your compliance program from scratch, so there is less workflow to manage. **First-year platform cost:** $7,733–$32,575 + your auditor's fee. Secureframe's range is Vendr's buyer data across company sizes (read 2026-09-29); the median contract is $20,000. Secureframe publishes no prices. **Sourced figures:** - price range: $7,733–$32,575 (Vendr buyer data: Secureframe, across company sizes, read 2026-09-29) - price median: $20,000 (Vendr buyer data: Secureframe, median contract, read 2026-09-29) - product: No published prices; Comply AI for remediation and risk (Secureframe website, read 2026-09-29) - g2: Steep learning curve, many controls to configure, manual work for unintegrated tools (G2 reviews of Secureframe, read 2026-09-29) - federal: Secureframe Defense for CMMC (March 2026); FedRAMP 20x Moderate authorization (June 2026) (Secureframe newsroom, read 2026-09-29) **When Secureframe is the better choice:** Secureframe is right for a team that needs several frameworks from one platform (SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC and FedRAMP among them) and has an engineer to connect its integrations. It is the strongest fit of the tools we compare for federal and defense suppliers: it launched a CMMC product in March 2026 and holds a FedRAMP 20x Moderate authorization. That buyer is usually at Series A or later. If SOC 2 is your only requirement this year, you would be paying for breadth you will not use. Full comparison: https://simpleaudit.io/compare/secureframe-alternative ### SimpleAudit vs Sprinto Teams choose SimpleAudit over Sprinto when they want to start with AI-generated compliance content immediately, without engineering-heavy integration setup. Sprinto automates compliance checks. SimpleAudit uses AI to build your compliance program from a conversation, so you start with policies and risks, not integrations. **First-year platform cost:** Not published (quote after a demo). Sprinto publishes no prices; its pricing page routes to a demo (read 2026-09-29), so there is no sourced first-year figure to show. **Sourced figures:** - pricing page: Three plans (Foundation, Growth, Enterprise), no prices, demo or plan finder only (Sprinto pricing page, read 2026-09-29) - integrations: 300+ (Sprinto product updates, May 2026, read 2026-09-29) - ai agents: AI agents, policy creation and an MCP connection for ChatGPT and Claude (Sprinto product updates, July–August 2026, read 2026-09-29) **When Sprinto is the better choice:** Sprinto is right for a team that wants automation to carry the ongoing work: it connects to your systems (Sprinto lists 300+ integrations), monitors controls continuously, and now runs AI agents that propose and apply fixes. Its Foundation plan targets startups on their first audit, and it syncs evidence with the audit firm A-LIGN. It pays off when an engineer can set up and maintain those integrations, common for B2B SaaS companies with a platform team. If you want to see a price before a demo, or would rather not give a vendor standing access to your cloud accounts, it is a poorer fit. Full comparison: https://simpleaudit.io/compare/sprinto-alternative ### SimpleAudit vs Comp AI Teams choose SimpleAudit over Comp AI when they need SOC 2 without an engineer to run the platform, and when a sales call is too slow for the deal they are trying to close. Comp AI gives its price only on a sales call, and its open-source edition is built for teams that can self-host. SimpleAudit is built for every other founder: published pricing, self-serve signup, nothing to install. **First-year platform cost:** Not published (quote after a call). Comp AI publishes no prices; its pricing page offers your price on a 20-minute call (read 2026-10-02). **Sourced figures:** - pricing: Quote-based: exact price given on a 20-minute call (Comp AI pricing page: no prices, no contract term, read 2026-10-02) - g2: Of 73 G2 reviews, 19 mention a lack of guidance and 13 a steep learning curve (G2 reviews of Comp AI, read 2026-09-29) - selfhost: Self-hosted edition: Docker, PostgreSQL and OAuth configuration (Comp AI open-source repository, read 2026-06-14) - integrations: 580+ (Comp AI website (company claim), read 2026-09-29) - frameworks: SOC 2, ISO 27001, HIPAA, GDPR, FedRAMP and more (Comp AI website, read 2026-09-29) - series a: $34M (Comp AI Series A announcement, 2026-09-17, read 2026-09-29) - customers: 1,000+ (Comp AI Series A announcement (company claim), read 2026-09-29) **When Comp AI is the better choice:** Comp AI is right for a technical team that wants an open-source core it can inspect or self-host, and an agentic platform that collects evidence from its systems and adds AI penetration testing. With a $34M Series A in September 2026, it has the money to keep building. If you have an engineer to run it and are comfortable getting your price on a sales call, it is a credible choice. If you are a pre-seed founder who wants to read the price before a call, SimpleAudit fits better. Full comparison: https://simpleaudit.io/compare/comp-ai-alternative ### SimpleAudit vs Compliance Consultants Teams choose SimpleAudit over consultants when they want ongoing compliance guidance year-round, not a one-time readiness engagement that leaves them on their own for the hardest part. Consultants get you audit-ready. SimpleAudit keeps you audit-ready, for 12 months straight, at a fraction of the cost. **First-year platform cost:** Quoted per engagement. Consultants quote per engagement, and the audit fee comes on top of the readiness fee. **When Compliance Consultants is the better choice:** A consultant is the right call when the problem is bigger than one SOC 2 report: you are regulated (HIPAA or PCI on top of SOC 2), your architecture spans several regions or clouds, or you need a person in the room for audit kickoff and the auditor's walkthroughs. A good consultant brings judgment from many audits. What a readiness engagement usually does not include is the year that follows: the reviews and records your controls need month after month. That is the part SimpleAudit is built to keep running for seed-stage teams. Full comparison: https://simpleaudit.io/compare/compliance-consultant-alternative --- ## SOC 2 Educational Content ### What Is SOC 2? SOC 2 (System and Organization Controls 2) is a compliance framework developed by the AICPA. It evaluates how organizations manage customer data based on five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Unlike prescriptive standards like PCI DSS, SOC 2 is principles-based. You define the controls that make sense for your organization, then an independent auditor evaluates whether those controls are properly designed and operating effectively. The Security criterion (Common Criteria) is required for every SOC 2 audit. The other four are optional. ### Who Needs SOC 2? Any organization that stores, processes, or transmits customer data should consider SOC 2. Common drivers: - Enterprise sales requirements (prospects require SOC 2 reports during due diligence) - Customer trust demonstration - Competitive differentiation - Regulatory alignment (overlaps with HIPAA, GDPR, state privacy laws) ### SOC 2 Type 1 vs Type 2 - **Type 1**: Evaluates control design at a specific point in time. "Are these controls properly designed?" - **Type 2**: Evaluates operating effectiveness over a period (3-12 months). "Are these controls actually working consistently?" Type 1 is a snapshot. Type 2 is a movie. Most enterprise customers require Type 2. **Recommended path:** Our recommended path is a security-only SOC 2 Type 2 with a 3-month observation window. A Type 1 is the option when a prospect needs a report in under about 3 months. Most teams reach audit-ready in 4-10 weeks depending on starting maturity (none ~8-10, partial ~6-8, strong ~4-6 weeks), plus coordination time for larger teams. AI-generated policies and guided remediation compress this from the traditional several months. The Type 2 report is renewed annually. ### SOC 2 Costs **First-year all-in for a startup (1-25 employees, security-only Type 2): ~$21,000-$47,000 with the lean stack; ~$37,000-$84,000 buying everything the traditional way** (typical bands, not strict sums: almost nobody lands at all-low or all-high across every line at once) (Small company 26-150: ~$29,000-$67,000 lean, ~$52,000-$96,000 traditional. Mid-size 151-299: ~$73,000-$139,000 lean, ~$95,000-$185,000 traditional.) - Audit fees: $5,000-$8,000 for a lean security-only Type 2 (3-month observation period, Security-only scope, peer-reviewed boutique CPA firm). Quotes from larger firms run $7,000-$25,000 at startup scale and up to $25,000-$36,000 for mid-size; audit cost scales with headcount, firm size, and number of Trust Services Criteria. (Our own audit was $35k: a larger firm at 200+ staff.) - Penetration test: traditionally $8,000+/year (third-party; commonly expected by auditors, though not strictly mandated for Security-only scope; recurs annually). Agentic penetration tests that satisfy SOC 2 start at $99 through SimpleAudit partners. - Tabletop exercises (incident response, disaster recovery, business continuity): traditionally $8,000-$10,000/year per facilitated exercise; included in SimpleAudit's Pro plan ($399/mo billed annually); recurs annually. - Security & monitoring tooling: $3,000-$12,000/year (SSO, MDM, EDR, log management, vulnerability management, training, background checks) - Compliance platform: SimpleAudit Essentials ~$2,388/yr ($199/mo billed annually). Enterprise platform prices are quoted with their sources in the Competitive Comparison section. - Internal effort: $10,000-$25,000 equivalent (15-25% of one person's time for 3-6 months) The audit and security tooling are unavoidable; the savings come from scope, format, and vendor choice, not from skipping the work. SimpleAudit replaces the controllable lines (the enterprise platform, the gap-analysis consultant, and the vCISO), and its partners and Pro plan collapse the pen-test and tabletop lines. Second-year costs drop ~20-35% (not 40-60%) because the one-time policy/control work is done, but the audit, pen test, tabletop exercises, security tooling, and platform all recur annually. **ROI:** One enterprise deal ($50k+ annual contract) typically pays for the entire compliance program. SOC 2 also eliminates 2-4 week security review delays in sales cycles. ## SOC 2 cost ranges (personalized calculator) SimpleAudit's interactive calculator (https://simpleaudit.io/tools/soc2-cost-calculator) estimates fully-loaded first-year SOC 2 cost for a security-only Type 2 from five inputs: team size, security maturity, infrastructure, whether policies already exist, and timeline pressure. The calculator shows both the lean-stack estimate and the typical traditional quote for contrast. Size bands follow SimpleAudit's segmentation: Startup 1-25 employees, Small company 26-150, Mid-size 151-299. The four cost buckets are: the CPA audit ($5K-$8K lean with a 3-month observation period and a peer-reviewed boutique firm; up to $36K traditional by size), annual testing plus tooling (agentic penetration test from $99 via SimpleAudit partners vs $7K-$25K traditional; tabletop exercises included in SimpleAudit Pro vs $8K-$20K traditional; security tooling $3K-$12K; the SimpleAudit platform at $2,388/yr), an optional vCISO/consultant ($0 with the lean stack: SimpleAudit's conversation-first guidance replaces the gap-analysis consultant and the vCISO), and your team's time ($10K-$60K of opportunity cost by size). Multi-cloud or rushed timelines add roughly 10-15% to audit and testing lines. ### SOC 2 Compliance Checklist From the SimpleAudit guide "SOC 2 Compliance Checklist for Small Teams" (https://simpleaudit.io/guides/soc-2-checklist). It starts with three decisions, then a six-week plan, then the controls in the order audits most often go wrong. 1. **Start Here: What to Do First**: Decide which systems the audit covers, which report you are buying, and which CPA firm will sign it. In the CBIZ 2024 SOC Benchmark Study of 193 SOC reports, failed user access reviews were the top reason for a qualified opinion, and user access reviews (15.6%), terminations (12%), and change management (11.7%) were among the most common causes of control exceptions. So control work starts with access control (CC6) and change management (CC8). 2. **Pick Your Scope First**: Scope is a system, not the whole company: the product customers buy plus the infrastructure, code, data stores, people, processes, and vendors behind it. A system is in scope if it stores or processes customer data, can change production, or controls who can reach either one. 3. **Choose the Audit and the Auditor**: The recommended path is a security-only Type 2 with a 3-month observation window. Security (the Common Criteria) is the one Trust Services Criterion every report must include; add Availability or Confidentiality only when a customer or a contract asks for it. A Type 1 is the option when a prospect needs a report in under about 3 months. Check the CPA firm's peer review; MJD Advisors, SimpleAudit's audit partner, is a peer-reviewed, US-based CPA firm. 4. **A Realistic 6-Week Readiness Plan for a 10-Person Team**: Six weeks to audit-ready if SSO, MFA, and code review already exist; 8-10 weeks from nothing. Turn on centralized logging in week 1, because log history counts from that day. 5. **Access Control (CC6): Where Most Audits Fail**: MFA everywhere, SSO and role-based access, approved provisioning, offboarding within 24 hours, quarterly access reviews, and a named owner for every service account. 6. **Change Management (CC8)**: Required code review, branch protection with no admin bypass, recorded emergency changes, and writing separated from deploying (or a second person reviewing each deploy after it ships). 7. **Risk Assessment and Governance (CC3, CC1)**: Information security policy, risk assessment, risk register, management oversight, and a code of conduct. 8. **Monitoring, Incidents, and Backups (CC7)**: Central logging and alerting, an incident response plan and incident log, vulnerability scanning with patch deadlines, and backups with a restore test. 9. **Vendor Management (CC9.2)**: A vendor list with risk tiers, SOC 2 reports or questionnaires for high-risk vendors, contract terms, and an annual re-review. 10. **Data Protection**: Encryption at rest and in transit, data classification, and data retention and disposal. 11. **People Security**: Background checks where local law allows, security awareness training, and confidentiality agreements. 12. **The 10 Evidence Items Every Auditor Asks For First**: The latest access review, an offboarding ticket, MFA enforcement, branch protection with approved pull requests, the risk register, logging settings, the vendor list, the incident log and plan, approved policies with acknowledgments, and training records. 13. **The Week Before Fieldwork**: Self-test the 10 evidence items, confirm every policy approval date falls before the window starts, and run a last gap check. --- ## What Auditors Actually Ask CPA auditors ask a narrower set of questions than most platforms suggest. After running SOC 2 firsthand and speaking with auditors at three firms (KPMG, Schellman, A-LIGN), these are the questions that come up in nearly every audit: **On policies:** - "Show me your information security policy. Who approved it, and when?" - "How do you communicate policy updates to employees? Show me the acknowledgment trail." - "What's your review cadence for these policies?" **On access:** - "Walk me through how a new employee gets access on day one and loses it on their last day." - "Show me the quarterly access review for [system the auditor picks]." - "How is privileged access different from standard access in your provisioning workflow?" **On vendors:** - "Show me your vendor inventory. For each critical vendor, what's their SOC 2 or equivalent attestation?" - "How do you re-assess vendors annually?" **On incidents:** - "Walk me through your last incident, from detection to resolution to post-mortem." - "What's your formal incident response procedure? Show me it was followed." **On change management:** - "How does a code change get from a developer's laptop to production? Show me an example with approvals." **On monitoring:** - "What are you monitoring, and who gets alerted? Show me a recent alert and the response." The pattern: auditors ask for evidence of operating effectiveness, not just policy existence. SimpleAudit's Journey Readiness scoring and Evidence Vault audit trail are designed to make these requests one-click answers. --- ## Coexistence With Other Frameworks SOC 2 overlaps substantially with other compliance frameworks. Teams pursuing SOC 2 often need HIPAA or ISO 27001 within 12-18 months, and the work isn't fully separate. ### SOC 2 + HIPAA If you handle Protected Health Information (PHI), HIPAA is mandatory regardless of SOC 2 status. The good news: SOC 2 Security criterion covers ~70% of HIPAA Security Rule technical safeguards. The delta: - HIPAA-specific: Business Associate Agreements (BAAs), PHI access logging, breach notification within 60 days, minimum-necessary access principle as a hard rule. - SOC 2 covers but HIPAA needs explicit documentation: encryption at rest, access controls, audit logging, workforce security training. Recommended sequence: SOC 2 first (broader market), then add HIPAA-specific controls when health data enters the system. SimpleAudit's policy framework and evidence vault carry forward; only the HIPAA-specific deltas need additional documentation. ### SOC 2 + ISO 27001 ISO 27001 is closer in scope to SOC 2 than HIPAA is, but more prescriptive. Annex A's 93 controls overlap heavily with SOC 2 Trust Services Criteria. Major differences: - ISO requires a documented Information Security Management System (ISMS) with formal scope statement, Statement of Applicability (SoA), and management review cadence. SOC 2 is principles-based and lets you scope organically. - ISO requires explicit risk treatment plans tied to each identified risk; SOC 2 risk register satisfies this with minor formatting changes. - ISO certification is a single bilateral assessment; SOC 2 is an attestation from a US-licensed CPA firm. These are different auditor pools with different deliverables. Recommended sequence: SOC 2 first if your buyers are US-based; ISO 27001 first if you sell into Europe or APAC. Doing both within 18 months is common, and SimpleAudit's policies, risk register, and evidence vault transfer with ~80% reuse. ### SOC 2 + GDPR GDPR is a privacy law, not a security framework. They don't replace each other, but they share controls (data classification, access logging, retention policies, breach notification). SOC 2 Privacy criterion (optional add-on) is the closest overlap. If GDPR applies to you (you process EU residents' personal data), add the Privacy criterion to your SOC 2 scope rather than running parallel programs. > Bottom line: If SOC 2 is your first compliance framework, you've done ~60-80% of the foundational work for HIPAA, ISO 27001, and GDPR. SimpleAudit's underlying policy + risk + vendor + evidence structure transfers; additional frameworks add deltas, not parallel programs. --- ## Frequently Asked Questions **Do I need a security background to use SimpleAudit?** No. The AI asks plain-English questions about your company and generates everything for you. You review and approve. No jargon, no certifications required. **How long does it take to get audit-ready?** It depends on your starting point, but most teams generate their SOC 2 policies in their first session with the AI. The journey readiness tracker shows progress across all compliance areas. **Will my auditor accept AI-generated policies?** Yes. Policies are based on SOC 2 best practices, customized to your company's actual tools and processes. Every policy is fully editable. Version history and approval workflows provide the audit trail auditors expect. **How is SimpleAudit different from Vanta or Drata?** Three key differences: (1) Zero integrations, so no weeks of technical setup, (2) AI-native, so the AI does the compliance work through conversation, (3) Built for startups, purpose-built for companies from 1 to 299 people. **What about the CPA audit cost?** You still need a CPA firm for the audit, and that's the same regardless of platform. A lean security-only Type 2 (3-month observation period, peer-reviewed boutique firm) runs $5k-$8k; larger firms charge up to $25k-$36k. SimpleAudit replaces the expensive compliance platform and consultant fees, not the auditor. **What's your pricing model?** Starter is $480/year, billed annually only (3-day free trial, no credit card required). That $480 is always credited toward the customer's first year of Essentials, billed annually. Essentials is the live plan at $199/month billed annually or $299/month month-to-month (no annual commitment). Pro is available today at $599/month, or $399/month billed annually ($4,788/year). A Partner plan ($599/month billed annually, $7,188/year, or $899/month month-to-month) serves compliance consultancies and vCISOs. Essentials and Pro: 7-day free trial (14-day for Partner). No credit card required. --- ## Resources ### Product pages - [SimpleAudit home](https://simpleaudit.io): AI-powered SOC 2 compliance for startups: get audit-ready through conversation, not spreadsheets. - [Features overview](https://simpleaudit.io/features): The integrated modules: policies, risks, vendors, evidence, access reviews, tasks and readiness. - [Pricing](https://simpleaudit.io/pricing): Plans, prices and free-trial lengths for Starter, Essentials, Pro and Partner. - [Partner program](https://simpleaudit.io/partners): For compliance consultancies and vCISOs who manage client compliance on SimpleAudit. - [How it works](https://simpleaudit.io/how-it-works): The step-by-step flow from discovery conversation to audit readiness. - [About / founder story](https://simpleaudit.io/about): Who built SimpleAudit, why, and who writes the content on this site. - [Free SOC 2 readiness score](https://simpleaudit.io/assessment): A five-minute assessment that scores how ready a company is for SOC 2. - [AI Policy Builder](https://simpleaudit.io/features/policy-builder): Chat. Review. Approve. SOC 2 policies generated from a conversation with version history and approval workflows. - [Risk Register](https://simpleaudit.io/features/risk-register): AI-suggested risks. 5x5 color-coded matrix. Mitigation tracking and Excel export. - [Vendor Management](https://simpleaudit.io/features/vendor-management): AI identifies your vendors. Document gap alerts. Security questionnaires and risk-level tracking. - [Evidence Vault](https://simpleaudit.io/features/evidence-vault): Version-controlled storage with full audit trail. Organized by control area. One-click export. - [Access Reviews](https://simpleaudit.io/features/access-reviews): Application registry with review scheduling. Calendar invites. AI identifies your apps. - [Task Management](https://simpleaudit.io/features/task-management): AI-generated task plans. Smart suggestions. Cross-feature integration with policies, risks, and reviews. - [Journey Readiness](https://simpleaudit.io/features/journey-readiness): Six-step progress tracker. Know exactly when you're audit-ready across policies, risks, vendors, and more. - [Connect Your AI Agents](https://simpleaudit.io/features/connect-ai-agents): Your AI agents push evidence straight into the vault via the MCP connector or API, and AI three-way reconciliation keeps it honest. Pro plan. ### Guides - [SOC 2 guides hub](https://simpleaudit.io/guides): All SimpleAudit SOC 2 guides: Type 1 vs Type 2, checklists, costs and preparation. - [The Complete Guide to SOC 2 Compliance](https://simpleaudit.io/guides/soc-2-compliance): Skip the consultant jargon. A practical SOC 2 compliance guide covering what auditors look for, how long it takes, and what it actually costs. - [SOC 2 Type 1 vs Type 2: Differences, Costs, and When to Choose Each](https://simpleaudit.io/guides/soc-2-type-1-vs-type-2): SOC 2 Type 1 vs Type 2: differences, when to choose each, typical timelines, costs, and the progression path from Type 1 to Type 2. - [SOC 2 Compliance Checklist for Small Teams: What to Do First and What Auditors Actually Fail](https://simpleaudit.io/guides/soc-2-checklist): A SOC 2 checklist for small teams: scope, auditor, a 6-week readiness plan, the controls auditors most often fail, and the 10 evidence items to have first. - [How Much Does SOC 2 Cost? A Complete Breakdown for 2026](https://simpleaudit.io/guides/soc-2-cost): True SOC 2 cost breakdown: audit fees, penetration testing, security tooling, compliance platform, and internal time, real numbers by company size. - [Your Prospect Asked for a SOC 2 Report and You Don't Have One. Now What?](https://simpleaudit.io/guides/prospect-asking-for-soc-2): No SOC 2 report yet does not mean the deal is dead. What procurement actually wants, what you can send this week, and the fastest honest path to a report. - [SOC 2 Policies List: The 19 Core Policies and What Each One Covers](https://simpleaudit.io/guides/soc-2-policies-list): The 19 core policies a first SOC 2 audit expects, what each one covers, the Common Criteria it supports, and how auditors check that you follow them. - [How Long Does SOC 2 Take? Realistic Timelines for Type 1 and Type 2](https://simpleaudit.io/guides/how-long-does-soc-2-take): A first SOC 2 Type 1 can take 6 to 10 weeks, and a Type 2 with a 3-month window about 5 to 7 months. How each phase adds up and what slows it down. - [What Is in a SOC 2 Report? Each Section Explained](https://simpleaudit.io/guides/what-is-in-a-soc-2-report): What a SOC 2 report contains: the auditor's opinion, management's assertion, the system description, your controls and tests, and how buyers read each. - [Does SOC 2 Require a Penetration Test? What Auditors Expect](https://simpleaudit.io/guides/soc-2-penetration-test-requirements): SOC 2 does not require a penetration test, but most auditors and buyers expect one. What the criteria say, how often to test, and how to use the results. - [How to Choose a SOC 2 Auditor: What to Check and What to Ask](https://simpleaudit.io/guides/how-to-choose-a-soc-2-auditor): How to choose a SOC 2 auditor: confirm a licensed CPA firm, check its AICPA peer review, ask the right questions, and compare quotes on identical terms. - [What Is a Trust Center? How SaaS Companies Share Security Proof](https://simpleaudit.io/guides/what-is-a-trust-center): A trust center is the public page where a company shows buyers how it protects data. What goes on one, what stays behind an NDA, and what to publish first. ### Tools - [SOC 2 cost calculator](https://simpleaudit.io/tools/soc2-cost-calculator): Estimates first-year SOC 2 cost for a security-only Type 2 from five inputs. - [SOC 2 Type 1 or Type 2 decision tool](https://simpleaudit.io/tools/type1-or-type2): Five questions that recommend a Type 1 or a Type 2 report for your situation. - [SOC 2 timeline estimator](https://simpleaudit.io/tools/soc2-timeline-estimator): Estimates how long SOC 2 will take from your starting point and audit window. ### Research - [State of SOC 2 for Startups 2026](https://simpleaudit.io/research/state-of-soc2-2026): State of SOC 2 2026: $55,000 median Type 2 audit estimate, a 9-week fieldwork window, 50% of enterprise deals stalled by security review. Every figure sourced. - [State of SOC 2 for Startups 2026: methodology](https://simpleaudit.io/research/state-of-soc2-2026/methodology): How the research report gathered, dated and cited its sources. ### Competitor comparisons - [Compare SimpleAudit and SOC 2 options](https://simpleaudit.io/compare): SimpleAudit against Vanta, Drata, Secureframe, Sprinto, Comp AI and consultants, and SOC 2 against ISO 27001, HIPAA, GDPR, PCI DSS and self-attestation. - [SimpleAudit vs Vanta](https://simpleaudit.io/compare/vanta-alternative): Vanta: $12,000–$28,000/yr for small teams (Vendr). SimpleAudit is from $40/mo (Starter, billed annually at $480). Essentials is $199/mo billed annually. - [SimpleAudit vs Drata](https://simpleaudit.io/compare/drata-alternative): Compare SimpleAudit vs Drata for SOC 2 compliance. AI-powered policy generation vs automation-first approach. See which is right for your startup. - [SimpleAudit vs Secureframe](https://simpleaudit.io/compare/secureframe-alternative): Compare SimpleAudit vs Secureframe for SOC 2 compliance. AI-native policy generation and risk assessment vs traditional compliance automation. - [SimpleAudit vs Sprinto](https://simpleaudit.io/compare/sprinto-alternative): Compare SimpleAudit vs Sprinto for SOC 2 compliance. AI-native compliance generation vs automation-driven compliance management for startups. - [SimpleAudit vs Comp AI](https://simpleaudit.io/compare/comp-ai-alternative): SimpleAudit vs Comp AI for SOC 2. Public pricing, self-serve signup, no endpoint agent, no sales call. Built for founders without a DevOps team. - [SimpleAudit vs Compliance Consultants](https://simpleaudit.io/compare/compliance-consultant-alternative): Compare SimpleAudit vs hiring a compliance consultant for SOC 2. See why startups choose year-round AI guidance over a one-time readiness engagement. ### Framework comparisons - [SOC 2 vs ISO 27001: Which Should US Startups Choose?](https://simpleaudit.io/compare/soc2-vs-iso27001): SOC 2 is the US enterprise standard; ISO 27001 is the global certification. Compare cost, timeline, and audience to choose the right framework, or both. - [SOC 2 vs HIPAA: Do You Need Both for Healthtech?](https://simpleaudit.io/compare/soc2-vs-hipaa): HIPAA is required by US federal law if you handle PHI. SOC 2 is voluntary market signal. Most healthtech needs both: here's when and why. - [SOC 2 vs GDPR: Do US Startups Need Both?](https://simpleaudit.io/compare/soc2-vs-gdpr): GDPR is EU law for personal data. SOC 2 is US enterprise trust signal. They overlap on security but solve different problems: here's when each applies. - [SOC 2 vs PCI DSS: Do Fintech Startups Need Both?](https://simpleaudit.io/compare/soc2-vs-pci-dss): PCI DSS is required if you touch cardholder data. SOC 2 is the enterprise sales credential. Most fintech needs both: here's how they differ. - [SOC 2 vs Self-Attestation: When Each Works for Startups](https://simpleaudit.io/compare/soc2-vs-self-attestation): Self-attestation works for 3-6 months with lenient customers. SOC 2 is what enterprise procurement requires. Here's when to bridge from one to the other. ### SOC 2 pages - [SOC 2 by stage and industry](https://simpleaudit.io/soc2): Which SOC 2 page applies to you: pre-seed, seed and Series A stage guides, and AI, fintech, healthtech, B2B SaaS and developer-tool industry pages. - [SOC 2 for AI Startups](https://simpleaudit.io/soc2/ai-startups): SOC 2 compliance for AI startups. Learn how AI companies address model security, data privacy, and trust service criteria to win enterprise deals. - [SOC 2 for Fintech Companies](https://simpleaudit.io/soc2/fintech): SOC 2 compliance for fintech startups: how SOC 2 intersects with PCI DSS, financial data security, and what payment-adjacent companies need in place. - [SOC 2 for Healthtech Companies](https://simpleaudit.io/soc2/healthtech): SOC 2 for healthtech companies: health-system buyer expectations, the HIPAA and SOC 2 overlap, and the attestation-letter tactic that closes deals early. - [SOC 2 for B2B SaaS Companies](https://simpleaudit.io/soc2/b2b-saas): SOC 2 compliance for B2B SaaS startups: how to get your SOC 2 report, what auditors look for, and how to use it to accelerate enterprise sales. - [SOC 2 for Developer Tools Companies](https://simpleaudit.io/soc2/devtools): SOC 2 for devtools startups: source code security, CI/CD pipeline controls, and what enterprise developer platforms require from their vendors. - [SOC 2 for Pre-Seed Startups](https://simpleaudit.io/soc2/pre-seed): SOC 2 at the pre-seed stage: when you need it, when you do not, and the security foundations that make a future report faster and cheaper. - [SOC 2 for Seed-Stage Startups](https://simpleaudit.io/soc2/seed): SOC 2 compliance at the seed stage. When to start, how to scope your program, and how to get your SOC 2 report without stalling your product roadmap. - [SOC 2 for Series A Startups](https://simpleaudit.io/soc2/series-a): SOC 2 at Series A: using your report for enterprise sales and investor diligence, and building a compliance program that scales with growth. ### Glossary terms - [SOC 2 glossary](https://simpleaudit.io/glossary): Plain-English definitions of SOC 2 terms. - [Attestation Report](https://simpleaudit.io/glossary/attestation-report): An attestation report is the formal document a CPA firm issues at the end of a SOC 2 audit. - [Audit Period](https://simpleaudit.io/glossary/audit-period): The audit period is the window of time covered by a SOC 2 Type 2 examination. - [Bridge Letter](https://simpleaudit.io/glossary/bridge-letter): A bridge letter is a short letter, written and signed by a service organization's management, that covers the time between the end of its latest SOC 2 audit period and the date a customer asks for assurance. - [Audit Scope](https://simpleaudit.io/glossary/audit-scope): Audit scope is the definition of exactly what a SOC 2 audit examines: the systems, Trust Services Criteria, locations and subservice organizations in play, and the period covered. - [Evidence](https://simpleaudit.io/glossary/evidence): Evidence is the documentation and artifacts that demonstrate a control was operating as designed during the audit period. - [Gap Analysis](https://simpleaudit.io/glossary/gap-analysis): A gap analysis is a structured review that compares your current security and operational practices against the SOC 2 Trust Services Criteria to identify which controls are missing, incomplete, or undocumented. - [Observation Period](https://simpleaudit.io/glossary/observation-period): The observation period is the span of time during which controls must be in place and operating effectively before a SOC 2 Type 2 audit can be performed. - [SOC 2 Type 1](https://simpleaudit.io/glossary/soc-2-type-1): A SOC 2 Type 1 report is an auditor's opinion that a service organization's controls are suitably designed at a single point in time. - [SOC 2 Type 2](https://simpleaudit.io/glossary/soc-2-type-2): A SOC 2 Type 2 report is an auditor's opinion that controls were suitably designed and operated effectively across an audit period. - [Availability](https://simpleaudit.io/glossary/availability): Availability is one of the five Trust Services Criteria in the SOC 2 framework. - [Common Criteria](https://simpleaudit.io/glossary/common-criteria): Common Criteria are the foundational set of controls required in every SOC 2 audit, regardless of which other Trust Services Criteria are in scope. - [Confidentiality](https://simpleaudit.io/glossary/confidentiality): Confidentiality is one of the five Trust Services Criteria in SOC 2. - [Privacy](https://simpleaudit.io/glossary/privacy): Privacy is one of the five Trust Services Criteria in SOC 2. - [Processing Integrity](https://simpleaudit.io/glossary/processing-integrity): Processing Integrity is one of the five Trust Services Criteria in SOC 2. - [Security](https://simpleaudit.io/glossary/security): Security is the required category in every SOC 2 audit, also known as the Common Criteria. - [Trust Services Criteria](https://simpleaudit.io/glossary/trust-services-criteria): The Trust Services Criteria, often abbreviated TSC, are the five categories defined by the AICPA that form the basis for SOC 2 audits. - [Access Control](https://simpleaudit.io/glossary/access-control): Access control is the practice of restricting which users and systems can read, modify, or execute actions on protected resources. - [Change Management](https://simpleaudit.io/glossary/change-management): Change management is the formal process for proposing, reviewing, approving, testing, and deploying modifications to production systems. - [Data Classification](https://simpleaudit.io/glossary/data-classification): Data classification is the practice of categorizing information based on sensitivity so that appropriate protections can be applied. - [Encryption](https://simpleaudit.io/glossary/encryption): Encryption is the process of transforming readable data into a form that cannot be understood without a decryption key, protecting information against unauthorized disclosure. - [Incident Response](https://simpleaudit.io/glossary/incident-response): Incident response is the structured set of activities a service organization performs when a security event is detected, including triage, containment, eradication, recovery, and post-incident review. - [Multi-Factor Authentication (MFA)](https://simpleaudit.io/glossary/mfa): Multi-Factor Authentication (MFA) is an access control that requires users to present two or more proofs of identity before gaining access. - [Risk Assessment](https://simpleaudit.io/glossary/risk-assessment): A risk assessment is the structured process of identifying threats and vulnerabilities to a service organization's systems and data, evaluating their likelihood and impact, and prioritizing them for remediation. - [Risk Register](https://simpleaudit.io/glossary/risk-register): A risk register is the canonical inventory of identified risks to a service organization, typically maintained as a structured table or database. - [Vulnerability Management](https://simpleaudit.io/glossary/vulnerability-management): Vulnerability management is the continuous process of identifying, evaluating, prioritizing, and remediating security weaknesses in systems, applications, and infrastructure. - [Auditor](https://simpleaudit.io/glossary/auditor): The auditor is the independent CPA who examines a service organization's controls and signs the SOC 2 attestation report. - [CPA Firm](https://simpleaudit.io/glossary/cpa-firm): A CPA firm is an accounting practice licensed to perform attestation engagements, including SOC 2 audits, under standards set by the AICPA. - [Service Organization](https://simpleaudit.io/glossary/service-organization): A service organization is any company that operates systems or processes data on behalf of its customers and is therefore the subject of a SOC 2 report. - [Vendor Management](https://simpleaudit.io/glossary/vendor-management): Vendor management, sometimes called third-party risk management, is the program that evaluates and monitors security and compliance risks introduced by external service providers. - [AICPA](https://simpleaudit.io/glossary/aicpa): The AICPA, or American Institute of Certified Public Accountants, is the professional organization that establishes auditing and attestation standards in the United States, including the SOC suite of reports. - [GRC (Governance, Risk, and Compliance)](https://simpleaudit.io/glossary/grc): GRC (Governance, Risk, and Compliance) is the combined practice organizations use to set direction, manage risk and meet legal and contractual obligations. ### Blog posts - [Blog](https://simpleaudit.io/blog): Longform articles on SOC 2 for startups and small teams. - [Why I Built a SOC 2 Starter Plan for Small Teams](https://simpleaudit.io/blog/starter-plan-soc2-audit-ready): SimpleAudit's Starter plan gets a small team ready for its first SOC 2 audit for $480/year. Security criteria only. Here's why I built it, and who it's for. - [Your AI Agents Should Be Collecting Your SOC 2 Evidence](https://simpleaudit.io/blog/push-soc2-evidence-from-ai-agents-mcp): Push SOC 2 evidence from your AI agents via MCP or API: programmatic evidence collection with no integrations, plus AI reconciliation that catches drift. - [The Solo Founder's SOC 2 Type II Readiness Checklist](https://simpleaudit.io/blog/solo-founder-soc2-readiness-checklist): A solo founder's non-technical guide to buying SOC 2 Type II: Type 1 vs Type II, TSC scope, the observation window, true cost, and a phased readiness checklist. - [SOC 2 when nobody on your team is a security person](https://simpleaudit.io/blog/soc2-no-security-person): Plain-language SOC 2 for founders without a security background: what SOC 2 is, why enterprises require it, and how to get your SOC 2 report without a CISO. - [Enterprise GRC Platforms Are Overkill for Seed-Stage Startups (And I Have the $24K Receipt to Prove It)](https://simpleaudit.io/blog/enterprise-grc-overkill-startups): I demoed Vanta and Drata before my SOC 2, and paid $24K elsewhere instead. Here's why seed-stage startups don't need enterprise GRC automation. - [SOC 2 Evidence Collection: What No One Tells You About the 12-Month Grind](https://simpleaudit.io/blog/evidence-collection-best-practices): My Teams recordings auto-deleted mid-audit. Here's the 12-month evidence-collection discipline that survives a real SOC 2 observation period. - [Skip SOC 2 Type 1: Here's Why You Should Go Straight to Type 2](https://simpleaudit.io/blog/skip-soc2-type1): Skip SOC 2 Type 1. A signed attestation letter mid-Type-2 unblocks deals just as fast, costs less, and proves real security from day one. - [SOC 2 Compliance Checklist for Startups & SMBs](https://simpleaudit.io/blog/soc2-compliance-checklist-startups-smbs): A step-by-step SOC 2 prep guide for startup founders and small business owners: scope, policies, controls, evidence, and what auditors actually look for. ### Legal - [Privacy Policy](https://simpleaudit.io/privacy): How SimpleAudit collects, uses and protects personal data. - [Terms of Service](https://simpleaudit.io/terms): The terms that govern use of SimpleAudit. - [Data Processing Agreement](https://simpleaudit.io/dpa): The data processing terms for customers of SimpleAudit. - [Sub-processors](https://simpleaudit.io/subprocessors): The third parties that process customer data on SimpleAudit's behalf. ### Open source SimpleAudit maintains a free, MIT-licensed open source repository of SOC 2 resources at https://github.com/joesimpleauditio/simpleaudit. It contains: - policy-templates: 12 ready-to-adapt SOC 2 policy templates (access control, incident response, vendor management, and more) - https://github.com/joesimpleauditio/simpleaudit/tree/main/policy-templates - readiness-checklist: a step-by-step SOC 2 audit readiness checklist for startups and small teams - https://github.com/joesimpleauditio/simpleaudit/tree/main/readiness-checklist - evidence-collection-guide: practical guidance on what evidence auditors expect and how to collect it - https://github.com/joesimpleauditio/simpleaudit/tree/main/evidence-collection-guide - cloud-mapping: control-to-service mappings for the four major clouds (aws, gcp, azure, and cloudflare) - https://github.com/joesimpleauditio/simpleaudit/tree/main/cloud-mapping ### Direct contact - Founder: joe@simpleaudit.io - Founder LinkedIn: https://www.linkedin.com/in/joseph-widi/ - Company LinkedIn: https://www.linkedin.com/company/simpleaudit - YouTube: https://www.youtube.com/@simpleaudit ### Also for AI agents - [llms-full.txt](https://simpleaudit.io/llms-full.txt): this file, the complete product reference - [llms.txt](https://simpleaudit.io/llms.txt): the quick reference - [Start a free trial](https://simpleaudit.io/sign-up): create a SimpleAudit account --- ## Company Information - **Product**: SimpleAudit - **Website**: [simpleaudit.io](https://simpleaudit.io) - **LinkedIn**: https://www.linkedin.com/company/simpleaudit - **YouTube**: https://www.youtube.com/@simpleaudit - **Founded**: Wisconsin, United States - **Infrastructure**: Microsoft Azure (East US 2 / Central US regions) - **Data residency**: United States only: data stored in Azure US regions; AI inference in the Azure US Data Zone - **Built by**: Joe. See Founder Story above. Self-funded, design-partner-driven, built from real SOC 2 experience.