.svg)
Ask what SOC 2 costs and you will get a number for the audit. That number is real, and it is usually not the biggest thing you will spend. There are five line items, and the one teams underestimate most does not appear on any invoice.
1. Readiness Assessment
Traditional compliance consultancies quote $20,000 to $50,000 for readiness work, often with a multi-week wait before they start. What you are buying is a gap analysis against the Trust Services Criteria and a remediation plan.
This is skippable in principle. In practice, skipping it usually means discovering your gaps during audit fieldwork, when fixing them is far more expensive in both money and calendar time.
2. Audit Fees
The CPA firm's fee for the examination itself. Commonly $10,000 to $60,000 or more, driven by how many Trust Services Criteria you included, the complexity of your system boundary, whether it is Type I or Type II, and the firm's positioning.
Type II costs more than Type I because the auditor is sampling evidence across a period rather than at a point in time. Only a licensed CPA firm can issue a SOC 2 report — if a vendor offers to “certify” you directly, they are not describing SOC 2.
3. Penetration Testing
CC7.1 asks for evidence that you test your controls rather than only documenting them. A penetration test is the strongest evidence available, which is why most auditors expect one.
Traditional pentesting firms quote $15,000 to $25,000 and multi-week lead times for compliance engagements. This is the line item where the gap between market rate and necessary cost is widest, and where scoping discipline pays off most: an audit-evidence pentest does not need to cover every system you own, only the ones inside your SOC 2 boundary.
4. GRC Tooling
Compliance automation platforms typically run several thousand to low five figures annually, scaling with headcount. They are genuinely useful for evidence collection, policy management, and continuous monitoring.
What they do not do is make you secure or replace the audit. They organise and collect evidence. A green dashboard is not an attestation, and auditors still test the underlying controls.
5. Internal Time — The Line Item Nobody Budgets
This is the one that surprises people. Someone has to write policies, chase evidence, sit through auditor interviews, coordinate remediation across engineering, and project-manage the whole thing.
For a first SOC 2, that is commonly a meaningful fraction of one person's year, spread across several people. At loaded salary rates, it frequently exceeds the audit fee. Budget it explicitly, or it comes out of your roadmap instead.
What Drives the Range
Trust Services Criteria in scope. Security only is the cheapest path. Each added category means more controls, more evidence, more audit hours. Add categories because a buyer requires them, not defensively.
System boundary. One product on one cloud account is a different engagement from four products across three environments and an acquired subsidiary.
Type I vs. Type II. Type II costs more per report but is what most enterprise buyers actually want. Paying for a Type I that nobody accepts is the expensive outcome.
Starting maturity. An organisation with existing access reviews, change management, and logging spends far less on remediation than one starting from scratch.
Where to Cut and Where Not To
Reasonable savings: scope tightly, do evidence collection in-house rather than paying a consultancy hourly for it, and shop the pentest line item hard — the price spread there is enormous relative to the quality spread.
False economies: skipping readiness and finding gaps at fieldwork, choosing the cheapest auditor if your buyers do not recognise the firm, and buying a Type I when your pipeline needs a Type II.
How the Numbers Actually Distribute
For a first-time SOC 2 at a small-to-mid company, a rough shape of the spend looks like this: audit fees and penetration testing are the two clearest invoices, readiness is optional but usually money well spent, tooling is a recurring subscription decision, and internal time is frequently larger than any of them.
The distribution shifts with maturity. An organisation with no existing controls spends most of its budget on remediation — engineering work to build what does not exist. An organisation with good hygiene spends most of its budget on audit and evidence, because the controls are already there.
This is worth modelling before you commit, because the two profiles call for different decisions. If remediation will dominate, spending on a consultancy to tell you what to fix is less valuable than spending on engineers to fix it.
Pricing Questions Worth Asking
To an auditor: is the quote fixed or hourly, what happens if scope changes mid-engagement, how many Trust Services Criteria does it assume, and what is the fee for the following year's Type II?
To a pentest provider: what exactly is in scope, is retesting included or charged separately, what is the lead time from contract to kickoff, and will the report be structured as audit evidence rather than a raw technical findings list?
To a GRC vendor: what does pricing look like at your headcount in two years, what is the contract term, and what happens to your evidence if you leave the platform?
That last one catches people. Evidence portability varies considerably between platforms, and discovering the answer during a renewal negotiation is not ideal.
Budgeting for Year Two and Beyond
SOC 2 is annual. The recurring cost is materially lower than year one but it is not small.
What recurs: audit fees at roughly the same level, penetration testing annually, tooling subscriptions, and internal time for evidence collection and the audit itself. What largely does not: readiness assessment, and the bulk of remediation.
The trap in year two is control drift. Controls that operated cleanly during your first observation window degrade quietly — access reviews slip a quarter, a new system launches outside the logging pipeline, an offboarding gets missed. Each one is a potential exception in your next report. Continuous monitoring is where GRC tooling earns its subscription, if you bought it.
When to Spend More, Not Less
Two situations justify paying above the cheapest option.
The first is auditor recognition. If your buyers are enterprise, an unfamiliar audit firm can generate procurement friction that costs more in deal cycle time than you saved on fees. Ask your sales team which firms appear in the security reviews they encounter.
The second is pentest quality when the report has a second job. If you plan to share the report with customers or use it to close security reviews, it needs to read well to a technical reader outside your company. A thin report satisfies an auditor and undermines a sales conversation.
Get a Real Number
Ranges only get you so far — your actual cost depends on scope, and scope depends on your environment. Our SOC 2 readiness assessment tells you what you are actually facing, and we quote transparently against it.
For the calendar version of the same plan, see the SOC 2 audit timeline. Working through controls? Start with the SOC 2 compliance checklist.