How to Get SOC 2 Certified: A Complete Guide for SaaS Startups

If a prospect has ever asked "do you have SOC 2?" and you had to say no, you already know the cost of not having it. SOC 2 certification is table stakes for B2B SaaS companies selling to enterprises — and increasingly to mid-market customers too. This guide walks you through exactly what SOC 2 is, what it takes to get certified, and how to do it without losing six months of engineering time.

What Is SOC 2?

SOC 2 (System and Organization Controls 2) is an auditing standard developed by the American Institute of CPAs (AICPA). It evaluates whether a company's systems and processes protect customer data across five Trust Service Criteria:

Security — the only mandatory criterion, covering logical access, incident response, and system monitoring
Availability — uptime and performance commitments
Processing Integrity — completeness and accuracy of data processing
Confidentiality — protection of confidential information
Privacy — collection, use, and disposal of personal data

Most startups begin with Security only (often called "SOC 2 Type I Security" or "SOC 2 CC controls"). That's the minimum auditors expect and the minimum prospects ask for.

SOC 2 Type I vs Type II

This is the most common source of confusion.

SOC 2 Type I is a point-in-time assessment. Your auditor reviews your systems and policies as they exist today and opines on whether your controls are designed correctly. Think of it as a design review.

SOC 2 Type II covers a period of time — typically 3, 6, or 12 months. Your auditor tests whether your controls were operating effectively throughout that period. They look for evidence: access logs, change management records, background check confirmations, incident response tickets.

Type I is faster and cheaper. Type II is what sophisticated enterprise buyers actually ask for — it proves your controls aren't just documented but actually used.

For most startups: get Type I first (1–3 months), then immediately start accumulating evidence for Type II.

The 6 CC Controls You Need to Pass

The Security criterion is organized around Common Criteria (CC) controls. Here's what each one requires:

CC6.1 — Logical Access Only authorised users can access your systems. Evidence: user lists from GitHub, AWS, your identity provider. No orphaned accounts. Access provisioning process documented.

CC6.2 — Multi-Factor Authentication MFA enforced everywhere. Evidence: MFA enforcement enabled in GitHub org settings, AWS root account MFA enabled, SSO configured with MFA required.

CC6.3 — Role-Based Access Control Access granted by role, not individually. Evidence: GitHub teams with permissions, AWS IAM roles (not individual IAM users). Principle of least privilege documented.

CC7.1 — System Monitoring You're logging what happens. Evidence: AWS CloudTrail enabled in all regions, logs shipped to S3, alerting configured, log retention policy.

CC7.2 — Vulnerability Management You're tracking and fixing vulnerabilities. Evidence: Dependabot alerts enabled, SLA for critical fixes, patch management process.

CC8.1 — Change Management Code changes are reviewed before reaching production. Evidence: GitHub branch protection enabled, PR reviews required, no direct pushes to main.

How Long Does SOC 2 Take?

Here's the honest timeline:

| Phase | Type I | Type II | |-------|--------|---------| | Gap assessment | 1–2 weeks | 1–2 weeks | | Remediation | 4–8 weeks | 4–8 weeks | | Evidence accumulation | N/A (point-in-time) | 3–12 months | | Audit fieldwork | 2–4 weeks | 4–6 weeks | | Report delivery | 2–4 weeks | 2–4 weeks | | Total | 2–4 months | 6–14 months |

The biggest variable is remediation. If your MFA enforcement is already on and your branch protection is already configured, you can move fast. If you're starting from scratch with no policies, no CloudTrail, and IAM users instead of roles, add two months.

What Does SOC 2 Cost?

Typical costs for a 10–200 person SaaS startup:

| Item | Cost | |------|------| | Auditor fees (Type I) | $8,000–$20,000 | | Auditor fees (Type II) | $15,000–$40,000 | | Compliance software (Vanta/Drata) | $15,000–$30,000/yr | | Policy writing (if outsourced) | $3,000–$8,000 | | Penetration test (often required) | $5,000–$15,000 |

The auditor fees are fixed. The compliance software is where you have room to move: Vanta and Drata cost $15k–$30k/yr and require a sales call just to get pricing. Modern tools like Circinova start at $499/mo with no sales call.

The Pre-Audit Checklist

Before your auditor walks in, make sure you have:

Access controls

[ ] User list reconciliation: every user in GitHub, AWS, and your identity provider is a current employee
[ ] MFA enforced at the org level (not just "encouraged")
[ ] Offboarding process documented and tested
[ ] Service accounts and shared credentials documented

System monitoring

[ ] AWS CloudTrail enabled in all regions, not just your primary region
[ ] CloudTrail logs shipped to S3 with versioning and Object Lock
[ ] Log retention policy (minimum 1 year for SOC 2)
[ ] Alerting on failed logins, privilege escalation, API key use

Change management

[ ] Branch protection on every production repository
[ ] PR review required (at least one approver)
[ ] Status checks required before merge
[ ] No force-push to main

Policies (seven required for SOC 2 Security)

[ ] Information Security Policy
[ ] Access Control Policy
[ ] Incident Response Plan
[ ] Business Continuity / Disaster Recovery Plan
[ ] Encryption Policy
[ ] Vendor Risk Management Policy
[ ] Acceptable Use Policy

Vendor management

[ ] Sub-processor list maintained
[ ] Security reviews completed for critical vendors
[ ] DPAs in place with all processors handling personal data

How Automation Speeds This Up

The evidence collection problem is the biggest time sink in SOC 2. Your auditor needs continuous evidence across the observation period — not screenshots from the week before the audit. Manually collecting GitHub PR logs, AWS CloudTrail events, IAM user lists, and Dependabot alerts every day for six months is genuinely painful.

Compliance automation tools connect directly to your sources of truth (GitHub, AWS, Jira, your identity provider) and pull evidence continuously. They evaluate each control against the collected evidence and flag gaps in plain English. Instead of spending 20–40 hours/month on compliance busywork, you get a live readiness score and an evidence package ready for your auditor.

Your Next Step

The fastest way to understand where you stand is a free readiness scan. Connect your GitHub and AWS accounts, and Circinova will tell you exactly which controls you're passing, which are failing, and what evidence is missing — in about 15 minutes.

Start your free SOC 2 readiness scan →

No credit card required. No sales call. If you're not ready to connect your tools yet, you can watch a 90-second demo of how it works.