The first time most small companies hear SOC 2, it is in a customer's email: "Do you have a SOC 2 report? Our vendor security review will require one." That is usually the whole message. It carries no explanation of what SOC 2 is, what readiness involves, or how long it takes. This article is the explanation those emails never include.
SOC 2 is an audit framework for how a company handles other people's data. It was designed for service organisations, which means it applies to most companies that hold customer information, run customer infrastructure, or handle customer financial details. It is not a certification you pass once. It is an ongoing program with an annual audit, and for a small firm the honest question is not whether it matters but when it starts to matter for you.
01 The framework
What SOC 2 actually is
SOC 2 is built on five trust services criteria: security, availability, processing integrity, confidentiality, and privacy. Security is mandatory and is the one that matters to most companies. The other four are optional, and you choose which ones your customers require. A company that sells a hosted product will likely need security plus availability. A company that processes data on behalf of clients may need confidentiality and privacy on top of that.
The audit comes in two forms. A Type 1 report inspects whether your controls are designed properly, at a point in time. A Type 2 report goes further: it verifies that those controls actually operated correctly over a period, usually three to twelve months, by sampling evidence across that window. Small companies commonly start with Type 1 to satisfy an urgent customer request, then move to Type 2 for their bigger or more demanding customers.
02 The trigger
Who asks for it, and when
Three things push a small company into SOC 2, usually in this order. The first is a customer in a regulated industry, finance, healthcare, or a government-adjacent business, running a vendor security review and asking for evidence. The second is a larger customer whose procurement process requires supplier checks, often a company big enough that passing is effectively a condition of the contract. The third is insurance: some cyber insurers now ask what security frameworks you follow when they price a policy, and a SOC 2 report is the cleanest answer a small firm can give.
The pattern we see is that it stops being optional the moment two customers have asked in the same year. The first request can be treated as an outlier. The second one is a signal that it will keep coming up, and building toward a report, instead of scrambling each time, becomes the cheaper option.
03 The work
What readiness actually involves
Readiness is the part that takes most companies months, and it is not complicated. It is mostly ordinary security made documented and verifiable. The audit asks for evidence, and evidence means that good practices have to be written down, assigned, and proven to keep happening.
- Policies. Access control, change management, incident response, backup and recovery, data handling. For a small company these are usually a few pages each, not corporate manuals.
- Access reviews. A dated record that someone periodically checks who can reach what, and removes people who should not be there anymore.
- Monitoring and patching. Evidence that security updates are applied on a schedule and that systems are watched.
- Backup testing. Proof that backups are taken and that a restore actually works, tested on a regular basis.
- Vendor management and training. A record that the people you rely on are reviewed, and that your own team has done security awareness training.
Read the list and most of it should look familiar. It is the same set of basics we put in our nine-step setup for small businesses. The difference with SOC 2 is that each item needs to be demonstrated with evidence, on a schedule, for the whole audit window.
04 The numbers
What readiness costs a small company
Published figures from audit firms and compliance guides for 2025 and 2026 put the pieces at these levels. A readiness assessment or gap analysis, the first look at where you stand against the framework, runs roughly $5,000 to $15,000 if done by a consultant. The formal audit itself is the bigger line: Type 1 typically lands between $5,000 and $20,000, and Type 2 between $10,000 and $40,000 for a small or mid-size company, with simpler environments at the low end and more complex ones higher. Fewer companies take the DIY route, which lowers the cash spent but costs heavily in team time. These are published ranges and budgets, not an estimate of what we quote.
The whole first program, readiness plus a Type 2 audit, commonly lands in the $30,000 to $80,000 range for a small company in published figures, depending on how much you already have in place. The cheapest path is the one where the ordinary security basics are already done and documented, which is why we push new clients through the basics before scheduling the audit. Going in unprepared is how the same audit costs double and takes twice as long.
05 The sequence
The honest order to do this in
The sequence does not start with hiring an auditor. It starts with a readiness assessment that tells you what is missing, and most of what is missing is the basics. Multi-factor authentication on everything important. Backups that are proven to restore. Access reviewed on a schedule. Patches applied on a schedule. If those are not in place and documented, no auditor will sign a Type 1 report, and a Type 2 is months away no matter who you hire.
Once the basics are real, the sequence is: close the gaps the assessment found, run a penetration test so the report can point to a recent one, choose a CPA firm to perform the audit, complete the observation period, and then keep the controls running because the annual audit re-examines everything. The first year is the heavy lift. After that it becomes an annual, and ordinary, rhythm.
06 Where an outside firm helps
What we actually do for clients here
Compliance is not a certification you buy, and it is not a tool you install. It is controls that work, and evidence that they work. We build the documentation, put the controls in place, run the testing, and prepare your team for the audit, across ISO 27001, SOC 2, GDPR, and HIPAA. We do the part most companies find hardest: making the good practices they already have into verifiable ones.
On the audit itself, we hand it to a licensed CPA firm, because that separation is what makes the report valid to your customers. If you want to know where your environment stands before deciding, a security audit is where that conversation starts, and you may find our piece on what a security audit costs useful background. If your customers are asking for a report and you are not sure how far along you are, the 15-minute call is a cheap way to find out.
