What SOC 2 Is and Where It Comes From
SOC 2 stands for Service Organisation Control 2. It was developed by the American Institute of Certified Public Accountants as a framework for evaluating how service organisations manage data to protect the interests of their customers. A SOC 2 report is produced by a licensed CPA firm that audits your controls against the AICPA's Trust Services Criteria. There are five Trust Services Categories: security (which is mandatory for all SOC 2 reports), availability, processing integrity, confidentiality, and privacy. Most startups pursue SOC 2 covering security only, sometimes adding availability and confidentiality when enterprise customers specifically request them. The security category, also called the Common Criteria, covers access controls, change management, risk mitigation, and monitoring controls. SOC 2 is not a certification in the ISO sense - it is a report issued by an auditor opining on whether your controls meet the criteria. Customers ask for the report as evidence of your security posture, not a badge or certificate.
Type 1 vs Type 2: What the Difference Means
SOC 2 Type 1 is a point-in-time report. An auditor reviews your control design and opines on whether your controls are suitably designed to meet the Trust Services Criteria as of a specific date. Type 1 is faster to achieve - typically three to six months from starting preparation - and provides a useful first signal to enterprise customers that you have implemented security controls. SOC 2 Type 2 is a report covering a defined observation period, typically six or twelve months. The auditor tests whether your controls were operating effectively throughout that period, not just on the audit date. Type 2 is more credible because it demonstrates sustained control effectiveness, not just correct design at a moment in time. Most enterprise procurement teams that require SOC 2 want a Type 2 report. If you do not yet have one, a Type 1 can serve as evidence that you are on the path to Type 2, but sophisticated procurement teams treat Type 1 as a provisional credential. The standard path for startups is to complete a Type 1, begin the observation period for Type 2 immediately, and achieve a Type 2 report six to twelve months later.
Controls That SOC 2 Evaluates
The Common Criteria that every SOC 2 security report covers address a set of control domains that map closely to good engineering practice. Access controls include logical access provisioning and deprovisioning, multi-factor authentication, role-based access control, and privileged access management. Change management covers how code changes are reviewed, tested, and deployed to production, including evidence of code review processes and release approval. Risk assessment requires a documented process for identifying and treating security risks. Monitoring requires evidence that you are logging security events, alerting on anomalies, and reviewing those alerts. Vendor management requires that third-party services handling customer data have their own security posture assessed. For AI products, additional areas of scrutiny include how LLM API providers are evaluated as vendors, how prompt logs containing customer data are protected, and how model outputs that might expose customer information are controlled. Audit evidence for AI systems needs to address these AI-specific data flows explicitly.
Preparing Infrastructure for SOC 2
The most time-consuming part of SOC 2 preparation is not implementing security controls - most development teams have reasonable controls already - it is creating and maintaining the evidence that those controls are operating consistently. Auditors want to see that you have documented policies and procedures, that access control lists are reviewed periodically, that vulnerability scans are run and findings addressed, that change management processes are followed for every production deployment, and that security incidents are logged and handled by a defined process. Compliance tooling platforms such as Vanta, Drata, Secureframe, and Sprinto automate a significant portion of evidence collection by integrating with your cloud infrastructure, identity provider, code repository, and HR systems to pull evidence continuously. For UK AI startups on Vercel, AWS, or GCP infrastructure using GitHub, these integrations cover the majority of Common Criteria evidence requirements. The residual manual work is policy writing, access review documentation, and ensuring your team actually follows the processes you document.
SOC 2 vs ISO 27001 for UK Teams
UK founders targeting both UK and US enterprise markets frequently need to choose between SOC 2 and ISO 27001 or find a path to achieving both. The practical guidance is straightforward: for UK and European enterprise buyers, ISO 27001 carries more weight and is a more familiar credential. For US enterprise buyers, SOC 2 Type 2 is the expected credential. If you are targeting both markets, pursue ISO 27001 first for UK traction, then layer SOC 2 as you develop US pipeline, using a compliance platform that maps controls across both frameworks to reduce duplicated effort. The controls overlap substantially. An organisation that has implemented ISO 27001-aligned controls has completed a large portion of the SOC 2 control implementation. The main differences are in audit process and report format rather than in the underlying security practices required.
Timeline and Cost for a Startup SOC 2
A realistic timeline for a startup to achieve SOC 2 Type 1 from a standing start is three to six months if you use a compliance platform. The phases are: gap assessment and remediation (four to eight weeks), policy documentation (two to four weeks), tool configuration and evidence collection (ongoing from day one of the observation period), and the Type 1 audit itself (two to four weeks from engaging the auditor to receiving the report). Type 2 requires an additional six to twelve month observation period after your Type 1 controls are in place. CPA firm audit fees for a startup SOC 2 typically range from USD 15,000 to USD 40,000 for Type 2, varying by firm, scope, and company size. Compliance platform costs add USD 10,000-30,000 per year but typically save more than that in internal labour and reduce audit preparation time significantly. SpeedMVPs builds infrastructure with SOC 2-relevant access controls, logging, and change management practices from the start, which reduces the remediation scope when clients later pursue formal audit.