Your SOC 2 Roadmap

You can earn a SOC 2 report without exhausting your team, but you need a plan that respects how the process really works. This SOC 2 Roadmap walks you through eleven steps, gives you realistic cost and timeline ranges, and explains the points of focus that trip up first time teams. Follow this SOC 2 Roadmap in order, and you will enter your SOC 2 examination with confidence instead of surprises.

databrackets is a SOC 2 readiness partner. We wrote this roadmap to help you understand what the process involves, which steps your team can confidently handle on its own, and which are worth bringing in expert help for. Some parts of SOC 2, like documenting policies or assigning internal ownership, are well within reach for most organizations. Others, like scoping your controls, closing gaps before the audit, and preparing evidence the way an auditor expects to see it, are where experience saves the most time and money. Knowing the difference up front helps you avoid costly missteps and delays and puts you in the best position to earn a strong SOC 2 report.

What is SOC 2 and Why do customers ask for it?

SOC 2 stands for System and Organization Controls 2. The American Institute of Certified Public Accountants (AICPA) created the framework, and licensed CPA firms perform the work. A CPA examines how your company protects customer information and runs its services, then writes an independent report that your customers can trust.

Three ideas anchor this SOC 2 Roadmap.

SOC 2 gives you a report, not a certificate. Your CPA firm forms an opinion, and no regulator stamps your company as “certified.”
The criteria describe outcomes, not a shopping list. The AICPA designed them to work no matter which specific controls you choose, so each company builds controls that match its own risks. No official SOC 2 checklist orders you to buy a particular firewall or tool.
The report exists for your customers. It answers security questionnaires faster, shortens vendor reviews, and gives buyers evidence they can hand to their own auditors.

What changed in 2026 and What did not

The SOC 2 Roadmap you follow today rests on the 2017 Trust Services Criteria with revised points of focus, which the AICPA published in 2022. The criteria themselves did not change. The AICPA revised the points of focus to reflect new technology and threats, evolving privacy laws, data storage and retention practices, and the difference between organizations that act as data controllers and those that act as data processors. The AICPA also updated its guidance on the system description in 2022.

Your SOC 2 Roadmap should also reflect a 2026 reality. The Journal of Accountancy reported in February 2026 that CPAs who perform SOC examinations worry that promises of fast and easy reports may cost quality and objectivity, and the AICPA’s SOC 2 Working Group is building educational resources for report users. The lesson for you is simple. Real assurance takes real work, and a credible CPA firm will tell you so.

The criteria in your SOC 2 Roadmap

The Trust Services Criteria (TSC) contains 61 individual criteria spread across five categories. You choose which categories belong in your report.

Category	Criteria	Count	Typical reason to include it
Security	CC1 through CC9	33	Included in every SOC 2 report; the other categories build on it
Availability	A1.1 to A1.3	3	You promise uptime or recovery
Processing Integrity	PI1.1 to PI1.5	5	You process transactions or calculations for customers
Confidentiality	C1.1 and C1.2	2	You protect information that contracts mark as confidential
Privacy	P1.1 through P8.1	18	You handle personal information about individuals

The Security groups, known as the common criteria, cover the control environment, information and communication, risk assessment, monitoring activities, control activities, logical and physical access, system operations, change management, and risk mitigation. The first five groups follow the COSO internal control framework. The last four add criteria that apply to technology and vendors.

What about points of focus? Each criterion carries points of focus, which describe important characteristics of that criterion. CPA firms count nearly 300 of them across all 61 criteria, and more than 200 sit under Security alone. Nearly 300 points of focus sounds alarming, but they work as guidance, not as a checklist. The AICPA says you do not have to show that you address every point of focus, and you may tailor them or add your own. Auditors use points of focus as a lens, so reading them helps you predict which questions will come.

Two examples show how this works in practice. Under CC4.1, the points of focus list penetration testing and vulnerability scans among the ways you can evaluate your controls. Under CC7.1, they describe periodic vulnerability scanning and timely fixes. The Trust Services Criteria do not order you to run a penetration test, yet many auditors and customers expect one, so plan to run one.

Estimated cost

Every SOC 2 Roadmap has a budget, and honest numbers help you plan. No CPA firm publishes a rate card, because each engagement letter reflects your scope. Treat the figures below as planning ranges, not quotes. Your actual cost depends on the complexity of your system and the size of your organization.

Line item	Typical range	What moves the number
Readiness phase (gap analysis, remediation, documentation)	$11,000 to $37,000	Systems in scope, headcount, number of gaps
Penetration test	$11,000 and up	Size of your application and network
CPA examination	$11,000 to $22,000	Report type, categories, scope, period length
Internal staff time	Varies widely	Often the largest cost of all

Together, the readiness phase, penetration testing, and CPA examination typically cost about $34,000 to $75,000 in year one, before tooling and your team’s time. Your final SOC 2 cost also depends on scope, so freeze your system boundary and your categories before you sign, ask for a fixed fee proposal, and compare at least three firms.

Monitoring tools (optional): SOC 2 doesn’t mandate an automated monitoring tool, but if you choose one to meet CC4.1, expect it to add a recurring subscription cost on top of your audit fees. It’s recommended for cloud-only businesses, where automation can collect evidence continuously, but smaller teams can start with manual reviews.

Estimated timeline

Time depends on how ready your controls are on day one. Most teams follow this pattern.

Phase	Typical time
Readiness phase (gap analysis, remediation, documentation)	3 to 4 months
Type 1 examination	1 to 2 months
Type 2 observation period	3 to 12 months

A first SOC 2 Type 1 report usually takes about 4 to 6 months from kickoff, which combines the readiness phase and the Type 1 examination. A first Type 2 report usually takes about 7 to 12 months when the first observation period runs 3-6 months, and longer when you choose a full 12. SOC 2 renewals run faster because your controls already exist.

The observation period deserves special attention. Market practice treats about three months as the practical floor, and first time reports often cover 3-6 months, and many companies move to12 months at renewal because enterprise buyers like a full year of evidence. A longer window costs more effort, but it also earns more trust.

SOC 2 Roadmap at a glance

Step	Your goal	Typical time	Cost signal
1	Confirm SOC 2 fits your customers	Internal time only	Internal time only
2	Define your system and scope	1 to 2 weeks	Internal time
3	Choose your TSC categories	1 to 2 weeks	More categories raise the fee
4	Choose Type 1 or Type 2	Internal time only	Type 2 costs more
5	Choose your CPA firm	2 to 4 weeks	Compare several quotes
6	Run a gap analysis	3 to 6 weeks	Readiness phase cost
7	Build controls and documentation	1 to 3 months	Tools and staff time
8	Operate controls and collect evidence	3 to 12 months (Type 2)	Staff time, optional platform
9	Complete your SOC 2 examination	4 to 8 weeks	CPA fee
10	Share and use your SOC 2 report	Ongoing	Minimal
11	Renew your SOC 2 Report every year	Yearly cycle	Annual CPA fee

Step 1: Confirm SOC 2 fits your customers

Every SOC 2 Roadmap starts with a reality check. Gather the contracts, questionnaires, and requests for proposals that mention security reports. Note which customers ask, what they ask for, and how soon they need it.

Then compare the report families:

SOC 1 examines controls that affect a customer’s financial reporting.

SOC 2 examines controls over security, availability, processing integrity, confidentiality, or privacy.

SOC 2 plus adds mapped requirements from another framework, such as HIPAA or NIST.

SOC 3 gives a short summary report that you can share publicly.

If your customers care about how you protect their data and run your service, SOC 2 fits. This is also a good moment to book short introductory calls with two or three CPA firms. You will not hire anyone yet, but their answers will shape your scope in Steps 2 and 3.

Step 2: Define your system and scope

A tight scope keeps your SOC 2 Roadmap affordable. The criteria can apply to a whole company, a division, an operating unit, or a function, so you decide what belongs in the examination. Work through four dimensions:

Services: Which products or services do customers rely on?

Boundaries: Which infrastructure, software, people, and procedures support those services?

Data: Which customer information does the system touch, and where does it live?

Vendors: Which providers, such as your cloud host, play a role? Raise the question of including them or carving them out in your introductory CPA calls, and confirm the decision once you hire a firm in Step 5.

Write a one-page system description now. You will refine that description later, and it becomes the backbone of your SOC 2 report.

Step 3: Choose your TSC categories

Your category choices shape the rest of the SOC 2 Roadmap, because each category adds criteria, evidence, and cost.

Security is the foundation of every SOC 2 report. Its common criteria (CC1 through CC9) apply no matter which other categories you choose, so you always start there. Then add categories only when a commitment justifies them:

Add Availability when you promise uptime or recovery targets.

Add Processing Integrity when customers rely on accurate, timely, and complete processing.

Add Confidentiality when contracts require you to protect designated information and dispose of it properly.

Add Privacy when you handle personal information about individuals.

A criterion can drop out when it does not apply to your services. For example, a company that never collects personal information directly from individuals may treat criterion P3.1 as not applicable. our CPA firm makes that call with you, so test your assumptions in your early CPA conversations and finalize them after you engage a firm.

Step 4: Choose Type 1 or Type 2

Type 1 and Type 2 give you two doors into the SOC 2 Roadmap. Both Type 1 and Type 2 reports examine the same subject matter, but they differ in depth.

Feature	Type 1	Type 2
What the CPA tests	Design of controls on one date	Design and operating effectiveness over a period
Opinion on operating effectiveness	No	Yes
Description of tests and results	No	Yes
Typical timeline	About 4 to 6 months	About 7 to 12 months
Best when	You need a report soon to unblock deals	Buyers expect proof that controls work over time

Many companies earn a Type 1 report first, then move to Type 2. Others skip Type 1 and go straight to Type 2 when their controls already run well. Ask your top customers which report they will accept before you decide.

Step 5: Choose your CPA Firm

By now you have spoken with a few CPA firms, so this step is where you compare them and make the choice. Your CPA firm becomes the most important partner on the SOC 2 Roadmap, and only a licensed CPA firm can issue a SOC 2 report. Consultants and software vendors can help you prepare, but they cannot sign the opinion.

Vet firms in five areas:

License and peer review: Confirm the firm practices as a licensed CPA firm and ask about its peer review results.

Independence: Ask how the firm separates advisory work from attestation work. The AICPA warns that designing or implementing systems for an attest client can threaten independence, so consider using a separate readiness partner.

Experience: Look for work with your technology stack, your size, and your customers.

Communication: Ask who does the testing and how quickly the team answers questions.

Proposal: Request a written, fixed fee scope that names the categories, the report type, and the period.

Treat promises of a report in days with caution. A firm that guarantees an outcome before it examines your controls is selling speed, not assurance.

Step 6: Run a Gap Analysis

A gap analysis turns the SOC 2 Roadmap into a to-do list. A readiness assessment is the service that delivers it: the assessor compares your current controls with the criteria you selected. Because a readiness assessment counts as consulting work, its findings stay internal, and your customers never see them.

A good gap analysis produces four outputs:

A control inventory mapped to each criterion

A list of gaps ranked by risk

A remediation plan with owners and due dates

An evidence plan that shows what you will collect and how often

Expect the gap analysis to take about three to six weeks. Smaller, cleaner environments finish sooner.

Step 7: Build Controls and Documentation

This step turns the SOC 2 Roadmap into daily habits. Close the gaps by writing policies, assigning owners, and putting controls in place. Common areas include:

Information security, access management, and change management policies

Multifactor authentication where your risk assessment calls for it

Regular reviews of who can access what

Peer review and approval for code and configuration changes

Vulnerability scanning and timely fixes

Backups with restore tests

An incident response plan that you rehearse

Vendor risk reviews

Security awareness training and background checks

Choose controls that fit your real risks. Copying a template that your team will never follow creates exceptions later. Most teams need one to three months here.

Step 8: Operate Controls and Collect Evidence

Evidence collection keeps the SOC 2 Roadmap moving. In a Type 2 examination, your controls must run consistently throughout the whole observation period, and your auditor tests samples from that period.

Build a rhythm from the first day:

Assign each control an owner and a schedule.

Save tickets, logs, approvals, meeting notes, and screenshots as you go.

Hold a short monthly check in to catch missed tasks.

Fix problems fast and record the fix, because a documented correction tells a stronger story than silence.

Automation helps, but it does not replace ownership. Software collects evidence, and people decide what the evidence should show.

Step 9: Complete your SOC 2 Examination

The SOC 2 examination is the destination of your SOC 2 Roadmap. Your CPA firm holds a kickoff, sends information requests, walks through your controls with your team, tests samples, and drafts the report. You confirm your control descriptions, review the draft, and sign a management representation letter.

The final report contains four core parts:

Management’s assertion: Your statement about the system and the controls.
System description: Your account of services, boundaries, components, and controls.
Service auditor’s report: The CPA’s opinion.
Tests of controls and results (Type 2 only): What the CPA tested and what the CPA found.

If the auditor finds exceptions, they appear in the tests of controls and results section. A few minor exceptions rarely sink a report, but serious problems can lead to a modified opinion. Timing matters here. In a Type 1 examination, close your gaps before the examination date. In a Type 2 examination, a control that failed during the observation period stays in the report even if you fix it afterward, so close known gaps before the observation period starts. Once it is under way, correct problems quickly and document the fix. Ask your CPA firm whether your report can include a management response to any exception.

Step 10: Share and use your SOC 2 Report

A finished report gives your SOC 2 Roadmap its payoff. SOC 2 reports serve specified parties, so most companies share them with customers and prospects under a nondisclosure agreement. Send a short cover note that names the scope, the period, and the opinion, and point readers to any complementary user entity controls in the system description. Those controls list what customers must do on their side.

If you want to show something publicly, ask your CPA firm about a SOC 3 report. A SOC 3 report summarizes the same criteria without detailed tests, so you can post it on your website.

Step 11: Renew your SOC 2 Report every year

Customers commonly expect a fresh report each year, so treat renewal as part of the SOC 2 Roadmap, not as an afterthought. Follow these habits:

Start the next observation period right after the last one ends, so no gaps appear.

Run change management on your controls and update your system description when your product changes.

Consider giving customers a bridge letter from management if a gap opens between reports.

Watch for AICPA updates to the criteria, the points of focus, and the attestation standards.

Add categories over time as your commitments grow.

Common Pitfalls

Most delays on a SOC 2 Roadmap trace back to a handful of mistakes:

Scope that sprawls. Every extra system and category adds cost, so include only what customers need.

Categories chosen for show. Adding Privacy or Availability without a real commitment creates work you cannot support.

Evidence left for last. Scrambling for six months of screenshots at the end guarantees exceptions.

Price as the only filter. The cheapest quote often hides narrow scope, thin testing, or independence problems.

Shelf policies. Auditors test what you do, not what your documents say.

Vendor blind spots. Criterion CC9.2 expects you to manage the risks that vendors and partners bring.

Underestimated staff time. Hundreds of hours of internal work usually cost more than the audit fee.

How databrackets can help you with your SOC 2 Roadmap

databrackets is an authorized & accredited FedRAMP 3PAO with ISO/IEC 17020:2012 accreditation from A2LA. We are also an authorized certifying body for ISO 27001 and an authorized C3PAO for CMMC.

For over 15 years, we have been helping organizations achieve compliance or certification with the most rigorous cybersecurity and data privacy standards, including NIST SP 800-53, NIST SP 800-171, NIST Cybersecurity Framework, ISO 27001, SOC 2, CMMC, HIPAA, and GDPR. We offer specialized Pen Testing Services to organizations who want to comply with these and other global security frameworks.

Services for SOC 2

databrackets guides you through every step of your SOC 2 Roadmap as your readiness partner. We work alongside licensed CPA firms, so your CPA firm performs the examination and issues the report while we prepare your organization. You can bring your own CPA firm, or we can work with our CPA partners. Because preparation and examination stay separate, your CPA firm keeps its independence.

Here is how we support you:

Gap analysis and readiness assessment: We compare your controls with the criteria you select and give you a ranked remediation plan.

Policies and documentation: We help you write the policies, procedures, and control descriptions your CPA firm will test.

Evidence collection: Our dbACE platform organizes your evidence, so your CPA firm receives it in a clear, consistent format.

Penetration testing: Our pen testing team delivers the testing many auditors and customers expect.

Staff training and CPA coordination: We train your people and keep the process moving from kickoff to report.

Ready to start? Connect with an expert or explore our SOC 2 readiness services.

Frequently Asked Questions

What is a SOC 2 report?

A SOC 2 report is an independent CPA firm’s opinion on a service organization’s controls over security, availability, processing integrity, confidentiality, or privacy. The CPA measures those controls against the AICPA Trust Services Criteria. Customers use the report to judge how well you protect their information and run your services.

Is SOC 2 a Certification?

No. SOC 2 is an attestation examination. A licensed CPA firm issues a report that carries an opinion, and no certificate exists. Companies often say “SOC 2 certified” as shorthand for “we have a SOC 2 report.”

How much does a SOC 2 audit cost?

Plan for about $34,000 to $75,000 in year one, before tooling and staff time. That range combines a readiness phase at $11,000 to $37,000, a penetration test starting around $11,000, and a CPA examination at $11,000 to $22,000. Your actual cost depends on the complexity of your system and the size of your organization, and each CPA firm quotes every engagement individually.

How long does a SOC 2 report take?

A first Type 1 report usually takes about 4 to 6 months from kickoff. That timeline combines a 3-to-4-month readiness phase with a 1-to-2-month examination. A first Type 2 report usually takes about 7 to 12 months when the observation period runs 3-to-6 months, and longer when you choose a full 12.

What is the difference between Type 1 and Type 2?

A Type 1 report tests the design of your controls on a single date. A Type 2 report tests both design and operating effectiveness over a period, includes the CPA’s opinion on operating effectiveness, and describes the tests and results. Type 2 takes longer because of the observation period, which commonly runs three to twelve months.

Which trust services categories do I need?

Security is the foundation of every SOC 2 report, so you always include it. Add Availability, Processing Integrity, Confidentiality, or Privacy only when your commitments to customers justify them. The 61 criteria divide into 33 for Security, 3 for Availability, 5 for Processing Integrity, 2 for Confidentiality, and 18 for Privacy.

Does SOC 2 require a penetration test?

No. The Trust Services Criteria do not order a penetration test. Criterion CC4.1 lists penetration testing as one way to evaluate your controls, and many auditors and customers expect one, so plan to run one.

Do I have to address every point of focus?

No. The AICPA says you do not have to show that you address every point of focus, and you may tailor them or add your own. Nearly 300 points of focus support the 61 criteria, and auditors use them as a lens when they test your controls.

Key Takeaways

SOC 2 gives you an independent CPA report, not a certificate.

The current criteria include 61 criteria across five categories, and the 2022 update changed points of focus, not the criteria.

Points of focus guide your thinking, and you do not have to satisfy each one.

Start with Security, then add categories only when a commitment calls for them.

Plan for about 4 to 6 months for a first Type 1 report and 7 to 12 months for a first Type 2 report.

Budget for the readiness phase, penetration testing, the CPA examination, tooling, and above all your team’s time.

Choose a licensed CPA firm that respects independence and quotes a clear scope.

Treat the SOC 2 Roadmap as a yearly cycle, not a one-time project.

Summary

SOC 2 rewards teams that plan. This SOC 2 Roadmap gives you the sequence: confirm the fit, define the scope, choose your categories, pick your report type, hire the right CPA firm, close your gaps, run your controls, and earn your report. Each step builds on the last, and the cost and timeline ranges above help you set expectations with your leaders and your customers.

Start with Step 1 this week. Gather the customer requests, name the services in scope, and talk with two or three CPA firms. A clear SOC 2 Roadmap turns a stressful request into a repeatable advantage.

Cost and timeline figures are planning estimates and do not represent quotes or AICPA requirements. Confirm current numbers with the CPA firms you interview.

Sources

AICPA

databrackets

Srini Kolathur

Srini is the Director of databrackets.com. He is a results-driven security and compliance professional with over 25 years of experience supporting, leading, and managing global IT security, compliance, support, and risk assessment in fortune 100 companies. Some of his key areas of focus are CMMC, SOC 2, ISO 27001, FedRAMP, NIST SP 800-171, NIST SP 800-53, NIST Cybersecurity Framework (CSF), HIPAA, Security Risk Assessments, among others. He is a Lead CCA for CMMC, CISSP, CISA, CISM, MBA. He is active in several community groups including Rotary International and TiE. He has verified all the technical information in this blog and co-authored it with Aditi Salhotra.

Co-Author: Aditi Salhotra

Manager – Digital Marketing and Business Development

Aditi is a Digital Marketing and Business Development Professional at databrackets.com. She is a strong advocate of good cyber hygiene and is proud of the company’s mission to safeguard organizations from cyber threats and ensure their business continuity in adverse situations.