SOC2IQ
How SOC 2 works
SOC 2 in plain words, with honest timings.
A SOC 2 report is a CPA firm's opinion on how well your company protects customer data. It is measured against the Trust Services Criteria. Security is always included; Availability, Confidentiality, Processing integrity and Privacy are added when your customers need them.
Type I or Type II?
| Type I | Type II | |
|---|---|---|
| What it says | Your controls are designed properly on one date. | Your controls worked, every day, over a period. |
| Observation period | None | At least 3 months; many auditors suggest 6 to 12. |
| When it helps | A customer needs something soon. | Most larger customers ask for this one. |
| Typical audit fee | $7.5K to $15K | about $5K to $20K |
Fees from Drata and Probo public cost pages, read 13 Nov 2026. Your auditor's quote decides.
The five stages, and who does what
- 1Scopea daySOC2IQ doesProposes your scope from five questions and installs the criteria library.You doConfirm which systems and categories are in.Your auditor doesNothing yet. Start collecting quotes.
- 2Close the gapsweeks, at your paceSOC2IQ doesRanks the gaps, drafts the policies, connects read-only sources.You doApprove policies, fix settings, attest what only you know.Your auditor doesOptional readiness call.
- 3Type I audit (optional)a few weeksSOC2IQ doesExports the evidence with fingerprints; gives the auditor a read-only view.You doAnswer auditor questions.Your auditor doesTests the design of your controls on one date.
- 4Observation period3 to 12 monthsSOC2IQ doesKeeps collecting evidence and warns before anything goes stale.You doRun your controls: reviews, onboarding, incidents.Your auditor doesWaits; some check in midway.
- 5Type II audit and reporta few weeksSOC2IQ doesHands over the full period of evidence.You doAnswer sample requests.Your auditor doesTests the period and issues your SOC 2 Type II report.
Choosing your auditor
- Only a licensed CPA firm can issue a SOC 2 report. Ask for their latest AICPA peer review.
- Get two or three quotes. Very low audit prices are a warning sign, not a bargain.
- Keep the people who prepare you separate from the people who audit you. SOC2IQ never audits.