Your guide to SOC 2 audits
GuidesSOC 2
November 29, 2022

Your guide to SOC 2 audits

A SOC 2 audit can often become a time of stress, indecision, and burnout for many companies. For some, the SOC 2 process may appear simple enough at the outset, but it soon turns into something much bigger. For others, it may seem like no level of preparation is enough. 

But it doesn’t have to be that way. Whether you’re new to SOC 2 audits, or you’re searching for a better way, this guide will give you a comprehensive understanding of what to expect. In addition, you’ll learn how Vanta is helping 4,000+ businesses save time and money throughout the SOC 2 journey. 

What is SOC 2 compliance?

SOC 2 is a compliance framework designed and maintained by the American Institute of CPAs (AICPA). SOC 2’s security guidelines are used as a standard to assess an organization’s security program and level of compliance.

To determine if your company is trustworthy, prospects, customers, and investors will want to see some kind of proof. That’s where SOC 2 comes in. Your SOC 2 report will serve as a testament to your company’s commitment to security and data privacy practices. 

To obtain a SOC 2 report and prove that your organization is adhering to security guidelines, a third-party compliance expert conducts an audit. A SOC 2 audit is an unbiased evaluation of how well your business creates security protocols and implements them. 

What is a SOC 2 audit and why is it important?  

A SOC 2 audit is the process of assessing the way an organization upholds security and compliance through policies, practices, and controls. There are two main reasons why companies go through SOC 2 audits.

1) Undergoing a SOC 2 audit helps businesses develop a deeper understanding of how secure (or not secure) their organization actually is. Protecting sensitive data should rank high on the list of priorities for any business.  

2) Organizations undergo SOC 2 audits in order to receive a SOC 2 report, which provides detailed information about internal security practices and protocols. Once obtained, this report can be shared with anyone who requests to see proof of security such as regulators, vendors, and especially prospective customers. 

SOC 2 Trust Services Criteria

SOC 2 reports contain detailed information about your organization’s adherence to five standard categories known as the Trust Services Criteria. ‍

  • Security: All SOC 2 reports include the Security category. Your systems and the data you store are protected against unauthorized access and unauthorized disclosure.
  • Availability: Your information and systems are available for operation and use.
  • Confidentiality: Confidential information is protected.
  • Processing integrity: System processing is complete, valid, accurate, timely, and authorized. Customer data remains correct throughout the course of data processing.
  • Privacy: Personal information is collected, used, retained, disclosed, and disposed of in accordance with pre-stated policies. Although the Confidentiality category applies to any sensitive information, the Privacy category applies only to personal information.

The difficult part of the SOC 2 process is knowing which requirements are important to your organization. Businesses have a lot of jurisdiction when it comes to designing their compliance environment. All SOC 2 reports include the Security category; the other categories are optional. AICPA’s Trust Services Criteria includes 33 main requirements and 28 optional requirements.

Are SOC 2 audits legally required?

SOC 2 is not a mandatory regulation, but you may want to pursue a SOC 2 report if you intend to do business with large, US-based enterprise companies. Most prospects and vendors will accept a SOC 2 report within 12 months of the report being issued. There is no mandatory time frame, but most companies complete a SOC 2 audit on an annual or semi-annual basis.

Who performs SOC 2 audits? 

A third-party certified auditor is required to conduct a SOC 2 audit and generate a verified report. Only CPA firms who are licensed can perform a proper SOC 2 audit. SOC 2 auditors are generally independent CPAs who are trained to evaluate the SOC 2 criteria and report on the policies and controls in place at your organization. 

It is important that an auditor remains objective and unbiased to maintain the integrity and accuracy of the report. Cost, timing, and reputation are just a few factors that come into play when choosing the right auditor.

How long does a SOC 2 audit take?

SOC 2 audit timelines are difficult to estimate because each audit process is totally unique. Your auditor and the resources you commit to the project are the two main variables that determine an accurate time frame. 

The other decisive factor is choosing between a SOC 2 Type I report and a SOC 2 Type II report. On average, Vanta customers can receive a SOC 2 Type I report in weeks, and a SOC 2 Type II report around seven months. These timeframes can be shorter for those who use an automated platform like Vanta. 

SOC 2 Type I vs. SOC 2 Type II audits

SOC 2 Type I is a static point-in-time assessment of your business’s security and compliance posture. An auditor will investigate this snapshot to discover whether or not the right controls are in place. Type I reports are ideal for businesses that need a SOC 2 report as fast as possible. 

SOC 2 Type II is a much more in-depth compliance review that takes place across six to 12 months. The auditor will evaluate the evidence collected over this period of time and determine the strength of controls and policies. Type II requires more time and resources, but offers a more meaningful and reliable attestation. Many prospects, especially in the enterprise, will specifically request a Type II report. 

How much does a SOC 2 audit cost? 

Before Vanta’s automated compliance platform, the fees for a SOC 2 audit could range between $10K to $70K annually. Similar to SOC 2 timelines, the average cost of a SOC 2 audit varies greatly depending on the size of the company, goals, and capabilities. Vanta offers many features in one package that would otherwise incur separate costs such as finding an auditor and risk assessments. 

How Vanta streamlines the SOC 2 audit process

Our first-to-market compliance platform has helped thousands of companies tackle SOC 2 audits with confidence. Here are just a few ways Vanta accelerates the SOC 2 process compared to other options. 

Find your ideal auditor with Vanta Seamless Audit

Even if you find an automated platform, you’ll still have to source an auditor on your own, but not with Vanta. We’ll save you hours of searching for the perfect auditor through Vanta Seamless Audit—our bundled package option that offers a premier platform matched with a five-star auditor. 

Get ahead of audit issues with Vanta Risk Management

‍Risk assessments are another piece of the SOC 2 puzzle that can add extra costs to the bottom line. Risk assessments serve as an important preparatory step before your audit takes place. Vanta’s Risk Management solution is built into our platform, offering one hub and interface during your audit. It includes automated workflows and pre-built content to guide you along the way. 

Automate your evidence collection and monitoring 

‍Manual tasks and processes involved in the SOC 2 process have been replaced with compliance automation. Vanta’s platform seamlessly integrates with your tech stack to gather necessary evidence for your auditor. The platform also continuously monitors your organization, alerting you when something needs to be updated or fixed.  ‍

Put access reviews on autopilot

Access reviews monitor user access to systems and applications to ensure only the right people have access to your organization’s systems. These reviews are a necessary, recurring exercise as part of most standards and frameworks. They can also be painful and time consuming. 

Vanta’s Access Review is a continuous automated solution that aligns to the required stages of standard frameworks. Using Vanta’s enhanced solution means faster, better, lower-cost access reviews that lead to streamlined audits, lower labor costs, stronger security posture, and accelerated revenue.

Written by
No items found.
Access Review Stage Content / Functionality
Across all stages
  • Easily create and save a new access review at a point in time
  • View detailed audit evidence of historical access reviews
Setup access review procedures
  • Define a global access review procedure that stakeholders can follow, ensuring consistency and mitigation of human error in reviews
  • Set your access review frequency (monthly, quarterly, etc.) and working period/deadlines
Consolidate account access data from systems
  • Integrate systems using dozens of pre-built integrations, or “connectors”. System account and HRIS data is pulled into Vanta.
  • Upcoming integrations include Zoom and Intercom (account access), and Personio (HRIS)
  • Upload access files from non-integrated systems
  • View and select systems in-scope for the review
Review, approve, and deny user access
  • Select the appropriate systems reviewer and due date
  • Get automatic notifications and reminders to systems reviewer of deadlines
  • Automatic flagging of “risky” employee accounts that have been terminated or switched departments
  • Intuitive interface to see all accounts with access, account accept/deny buttons, and notes section
  • Track progress of individual systems access reviews and see accounts that need to be removed or have access modified
  • Bulk sort, filter, and alter accounts based on account roles and employee title
Assign remediation tasks to system owners
  • Built-in remediation workflow for reviewers to request access changes and for admin to view and manage requests
  • Optional task tracker integration to create tickets for any access changes and provide visibility to the status of tickets and remediation
Verify changes to access
  • Focused view of accounts flagged for access changes for easy tracking and management
  • Automated evidence of remediation completion displayed for integrated systems
  • Manual evidence of remediation can be uploaded for non-integrated systems
Report and re-evaluate results
  • Auditor can log into Vanta to see history of all completed access reviews
  • Internals can see status of reviews in progress and also historical review detail

PCI Compliance Selection Guide

Determine Your PCI Compliance Level

If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.

When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.

Answer a few short questions and we’ll help identify your compliance level.


Does your business offer services to customers who are interested in your level of PCI compliance?


Identify your PCI SAQ or ROC level

The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.

Good news! Vanta supports all of the following compliance levels:


A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.

Get PCI DSS certified


A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.

Learn more about eCommerce PCI

for service providers

A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.

Use our PCI checklist

Level 1 for service providers

A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).

Automate your ROC and AOC

Download this checklist for easy reference


Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.

The compliance news you need. Delivered securely to your inbox.

Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes