The SoC 2 Guide: figure out what you need and how much it will cost

- **SoC 2** (System and Organization Controls 2) is a US auditing standard developed by the American Institute of CPAs (AICPA). It certifies that a service provider (e.g., a cloud company, a SaaS startup) has proper controls in place to protect customer data — covering security, availability, processing integrity, confidentiality, and privacy. - Many enterprise customers and B2B buyers now **require** their vendors to have SoC 2 compliance as a condition of doing business. It has become a de facto baseline for any company handling other companies' data. - Achieving SoC 2 involves hiring an independent CPA firm to audit your organization's policies, procedures, and technical controls. The process typically takes 3–12 months and can cost anywhere from roughly $20,000 to $100,000+ depending on company size, scope, and auditor. - The site soc2.fyi is an independent reference/guide (not an auditor or vendor) that walks founders and operators through what SoC 2 is, what the different "trust service criteria" mean, and what pricing to expect — helping first-timers figure out whether they need it and how to budget.