CertAssistCertAssist
Try the live demo Get started
SOC 2 for SaaS companies

How to get SOC 2 certification: 7 steps for SaaS startups

A customer has asked for your SOC 2 report. Here is how to get SOC 2 certified, step by step, with every control, policy and piece of evidence kept in one place.

Start your SOC 2 Try the live demo

US$225 a month during the launch. No integrations, no sales call.

SOC 2 for SaaS companies, without the overwhelm

Most SaaS startups get SOC 2 because a bigger customer asks for it. Three decisions make it far simpler.

Start with Security only

Scope your first report to the Security criterion. Add Availability or Confidentiality later, when a customer actually asks for them.

Type 1 first, then Type 2

A Type 1 report can unblock a deal quickly. A Type 2 then shows your controls working over an observation period of typically 3 to 12 months.

Fix the usual gaps early

MFA everywhere, quarterly access reviews, clean offboarding and vendor reviews are what auditors most often flag. Sort them before the audit starts.

How to get SOC 2 certified in 7 steps

The same path works for a Type 1 or a Type 2. If you are working out how to get SOC 2 Type 2 certification, steps 6 and 7 are where the two differ.

  1. Scope itPick the systems, people and Trust Services Criteria in scope. Security is the only required criterion.
  2. Choose Type 1 or Type 2Type 1 checks your controls are designed well on one date. Type 2 checks they operated over a period. See Type 1 vs Type 2.
  3. Run a gap assessmentCompare what you do today with what SOC 2 asks for. Our readiness assessment guide walks you through it.
  4. Write your policiesStart from templates rather than a blank page, then make them true to how you actually work.
  5. Put controls in place and collect evidenceTurn on MFA, run access reviews, log changes, and save the proof against each control.
  6. Run the observation period (Type 2)Keep the controls running and the evidence flowing, typically for 3 to 12 months. More on the observation period.
  7. Pick a CPA firm and complete the auditOnly a licensed CPA firm can issue a SOC 2 report. Give them read-only access and answer their questions.

Work through all 7 steps on one simple board.

Start your SOC 2

Getting SOC 2 certified: quick answers

Is SOC 2 a certification?

Strictly, no. SOC 2 is an attestation report issued by a licensed CPA firm, not a certificate. Most people still say SOC 2 certification, and the steps to get SOC 2 certified are the same whichever word you use.

How do you get SOC 2 Type 2 certification?

To get SOC 2 Type 2 certification you scope the audit, put your controls in place, then keep them operating with evidence over an observation period of typically 3 to 12 months. A CPA firm then tests that period and issues the report. A first Type 2 often uses three to six months to reach a report sooner.

How long does it take to get SOC 2 certified?

A Type 1 report can follow soon after your controls are in place. A Type 2 needs the observation period on top, typically 3 to 12 months, plus a few weeks for the auditor to write the report. A common startup path is Type 1 first to unblock sales, then Type 2.

How much does it cost to get SOC 2 certified?

The biggest cost is the independent auditor, commonly US$10,000 to US$30,000 or more for a Type 2, plus a penetration test if required. Compliance software is extra: CertAssist is US$225 a month. Our SOC 2 cost breakdown has the detail.

Do SaaS companies need SOC 2?

There is no law that requires it, but SOC 2 for SaaS companies has become the standard way to prove security to business customers, particularly in the US. If larger customers keep sending you security questionnaires, a SOC 2 report usually answers them in one go. See also SOC 2 for startups.

Start your SOC 2 today.

Flat US$225 a month during the launch, normally US$375, or US$2,475 a year. Every framework included. No integrations, no sales call.

Get startedTry the live demo
Get startedSee pricing