Get audit ready
What it takes to get audit ready for SOC 2, and what it costs
Before you book an auditor, you need policies written for your company, lists of your risks, vendors, people and systems, access reviews, and evidence that your controls are running.
For a startup with one cloud and no hard deadline, the first year costs about $5,000–$11,000 with a lean set-up. The preparation takes about six weeks with the basics in place, or 8 to 10 weeks from nothing.
What you build before the audit
SOC 2 looks at five categories: security, availability, processing integrity, confidentiality and privacy. AICPA's SOC 2 page names them, and the set-up here covers all five.
An auditor checks what you already have in place, so this work comes before you book one. Here is what you end up with:
- Discovery: a guided conversation that records how your company works, so the rest is written for you.
- Policies written for how your company actually works.
- Gap analysis: what is missing, in plain words.
- Risk register: what could go wrong, how likely it is, and what you are doing about it.
- Vendor list: the companies you rely on, and how you reviewed them.
- Personnel list: who works at your company, and the records an auditor asks to see for each person.
- Asset inventory: the systems and devices your company relies on.
- Access reviews: a regular check that the right people have the right access.
- Evidence vault: one place for the files that show your controls are running.
- Readiness score: how close you are, updated as you go.
What the auditor package contains
When you are ready, you download one ZIP file with an index. It holds your policies, your evidence and its register, the risk register, the vendor list, the personnel list, the asset inventory and your access reviews.
You can invite your auditor with read-only access, so they can look around without changing anything. You book the auditor separately, and our guide to choosing a SOC 2 auditor covers what to ask.
How long it takes
It takes about six weeks if you already have the basics in place, such as single sign-on, multi-factor login and code review, and 8 to 10 weeks if you are starting from nothing. Audit ready means your observation window or your fieldwork is booked to start.
Someone has to own the work. A compliance owner, usually a CTO, a VP of Engineering or an operations lead, spends 15-25% of their time over a 3-6 month preparation. Those hours are the same whichever route you take, so the totals on this page do not put a price on them.
What it costs
The totals on this page come from our SOC 2 cost guide. They cover the audit, a consultant where the traditional route needs one, the platform and the annual tests. Security tooling and your team's hours are not in the total.
The audit is a separate bill whichever tools you use. A CPA firm has to perform it, as AICPA's SOC 2 page explains. A 3-month observation period, Security-only scope and a peer-reviewed boutique firm can bring a first Type 2 report down to $5,000-$8,000.
Four ways to do SOC 2: what each costs
| Approach | Year 1 Tool Cost | Internal Effort | Best For |
|---|---|---|---|
| Consultant-led | Quoted per engagement | Low: they do most of it | Companies with budget and no internal capacity |
| Vanta | $12,000–$28,000/yr (Vendr buyer data) | Medium: you configure integrations | Teams with someone to connect and maintain integrations |
| SimpleAuditBest value for startups | $480 one time, 12 months of access | Low: AI handles policies, risks, evidence | Startups and SMBs, 1–299 employees |
| DIY (spreadsheets) | $0 | Very high: rebuild everything manually | Teams with deep compliance experience |
Consultant-led
Companies with budget and no internal capacity
Vanta
Teams with someone to connect and maintain integrations
SimpleAudit
Best valueStartups and SMBs, 1–299 employees
DIY (spreadsheets)
Teams with deep compliance experience
What to budget by company size
Run the numbers for your team
How many people are on your team?
The plan for this stage
Prepare
Get audit ready
$480 one time
12 months of access. Does not renew.
3-day free trial, no card
Up to 5 seats
- AI interview learns how you work
- AI writes policies that match it
- Each gap shown with its fix
- Controls come from your own policies
- AI chat knows your business and what's next
- Readiness score that says when to book
Unused months are credited toward Prove when you book an audit.
The other stages
Frequently asked questions
How much does SOC 2 cost?
For a startup with one cloud and no hard deadline, a first year runs about $5,000–$11,000 with a lean set-up and $31,000–$120,000 bought the traditional way. Security tooling and your team's hours are not in the total.
How long does it take to get audit ready?
About six weeks with the basics in place, and 8 to 10 weeks from nothing. The basics are single sign-on, multi-factor login and code review.
What is in the auditor package?
One ZIP file with an index, holding your policies, your evidence and its register, the risk register, the vendor list, the personnel list, the asset inventory and your access reviews. You can invite your auditor with read-only access too.
Does the price include the audit?
No. You book the audit separately, because a CPA firm has to perform it, as AICPA's SOC 2 page explains.
Does Prepare renew?
No. You pay $480 once for 12 months of access. There is no monthly fee.
Is there a free trial?
Yes, 3 days with no card. You pay only if you keep it. The free readiness score also shows where you stand before you start.
What happens when the 12 months end?
Access stops and the plan does not renew. Your data is kept at least 12 months, with 30 days' email notice before deletion, and you can ask for an export, as our terms set out.
What happens to months I do not use?
Unused months are credited toward Prove when you book an audit.