How much does SOC 2 cost, and why the answer depends on your scope
A customer or bank that now requires a SOC 2 report is asking for something the CPA firm prices, not the vendor. The fee is set by the CPA firm performing the examination based on its professional judgment, and the only published US government range is the Justice Department's October 2024 estimate in the Federal Register at 89 FR 86116. That analysis cited vendor-sourced figures of $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2 audit, which cover the audit alone. The same document gave a second, broader set that adds readiness assessment, remediation and consultant fees: $15,000 to $50,000 for a Type 1 and $30,000 to $75,000 for a Type 2 at small and medium businesses, rising to $50,000 to $100,000 and $75,000 to $150,000 for large ones. Treat these as orientation figures from a 2024 rule, not as a quote for your organization.
The two sets differ mainly in what you pay for beyond the opinion itself. The audit line covers the CPA firm's planning, testing and report. The broader line also covers the work that makes the audit pass: the gap assessment, the policy and control build-out, and the remediation of controls that do not yet exist or do not run consistently. Your position on that spectrum matters more than the firm's rate card. Ask each firm for a quote that separates its audit fee from any readiness or tooling work, states whether the Type 1 fee is credited toward a later Type 2, and lists the criteria it assumes are in scope. A quote that does not show these lines cannot be compared.
Four factors move a real quote most: the report type, the number of trust services categories beyond security, the size and complexity of the system and its locations, and how much control work already exists. Each added category brings extra criteria to design, operate and test, and a Type 2 requires evidence across an observation period. Organizations that already run access reviews, change tickets and logging need less remediation than those starting from policy. DeployOpen plans, implements and documents the self-hosted platforms and controls that produce this evidence, inside your own infrastructure, on a fixed written scope. DeployOpen does not issue SOC 2 reports, attestations or certifications; only an independent CPA firm does that, so the examination fee sits outside any DeployOpen quote.
Who is paid for what in a SOC 2 budget
This table shows who is paid for each part of a SOC 2 budget, whether the cost is one-time or recurring, and what moves the amount. Read it as a checklist when you ask for quotes, because the CPA firm's fee, tool subscriptions and internal time are separate lines that rarely appear together. The main takeaway is that the report fee is only one part of the total spend.
| Cost component | Who is paid | One-time or recurring | What drives the amount |
|---|---|---|---|
| CPA firm examination fee | The licensed CPA firm that issues the report | Recurring each examination cycle | Type 1 or Type 2, number of categories in scope, system complexity and the firm's professional judgment |
| Readiness assessment | A consultant, or the CPA firm if independence rules allow | Usually one-time before the first examination | Number of systems and locations, existing policy maturity and how much gap analysis is requested |
| Remediation and engineering work | Internal engineers, or an implementation partner or contractor | One-time for gaps, then ongoing upkeep | Number of control gaps found, state of identity, logging and change processes, and cloud architecture |
| Implementation partner | A firm that configures systems and prepares evidence, under a written scope | One-time build, with optional retainers for upkeep | Scope of platforms, integrations and hardening, and whether evidence collection is automated |
| Compliance tooling | Tool vendors or hosting providers, billed separately from the CPA fee | Recurring subscriptions, plus setup effort | Number of users and integrations, and whether the tool is self-hosted or vendor-hosted |
| Internal staff time | Your own employees, paid through payroll | Recurring, with a heavier first cycle | Owner count for each control, number of access reviews, and size of the evidence request list |
| AICPA guide and criteria purchases | AICPA, for the practitioner guide; the criteria can be downloaded free with an AICPA account | One-time per edition | Choice of edition and membership status; confirm current pricing on the AICPA site |
What the CPA firm's fee covers and how Type 1 and Type 2 change it
The fee for a SOC 2 examination is set by the CPA firm that performs it, and it must rest on the service auditor's professional judgment. AICPA ethics staff wrote in April 2026 that a SOC tool provider setting or unilaterally changing the fee in a bundled package threatens compliance with the AICPA Code (ET 1.230.030, determining fees). In practice, if a software vendor quotes one number that covers both the platform and the audit, or changes the audit fee without the CPA firm's involvement, treat that as a warning sign. Ask the CPA firm for its own engagement letter with fees itemized, and read the Journal of Accountancy's April 2026 discussion of tool provider ethics risks before you sign anything that bundles the two.
The report type drives much of the examination fee. A Type 1 report tests whether controls are suitably designed at a single date, so the auditor's work is concentrated around that point. A Type 2 report adds an opinion on operating effectiveness over a period, so the auditor must select samples and test controls across the whole observation window. That longer testing span is why Type 2 costs more. The Justice Department's regulatory analysis for its October 2024 proposed rule on US sensitive personal data (89 FR 86116) cited vendor-based estimates of $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2 audit. Those figures cover the audit alone, not readiness work, so they are a starting reference rather than a quote.
The same analysis also cited estimates that include readiness assessment, audit, remediation and consultant fees: $15,000 to $50,000 for a Type 1 and $30,000 to $75,000 for a Type 2 at small and medium businesses, and $50,000 to $100,000 and $75,000 to $150,000 respectively for large ones. Ask every bidder for a fee that separates the examination from readiness and remediation work, with the report type, period and categories named for each line. That split shows you which part is the CPA firm's independent examination and which part is preparation you can compare with other providers, and it prevents readiness work from quietly reappearing inside the audit fee.
What makes a SOC 2 cost more or less
The CPA firm's fee is only one part of what a SOC 2 costs. The bigger differences come from how much is in scope, how many systems and third parties the description must cover, and how much control evidence already exists before the examination starts. Each card below names a driver and the decision that moves it.
Trust services categories in scope
Every SOC 2 covers the 33 common criteria, so security is a fixed cost. Adding availability adds 3 criteria, confidentiality adds 2, processing integrity adds 5 and privacy adds 18, and each added criterion must be designed, operated and tested. Ask your CPA firm to justify each category against the commitments you make to customers, and drop any category your contracts do not require.
Number and complexity of systems
Each production system, environment and office location in the system description adds sampling, evidence and walkthroughs. A single cloud account with one application costs far less to examine than several regions, tenants and legacy services. Define the boundary tightly and retire unused systems before fieldwork so they are not sampled.
Subservice organizations and carve-out
Cloud hosts, payroll providers and other subservice organizations can be included in the report (inclusive) or excluded with their own SOC reports referenced (carve-out). Carve-out usually means less testing of those providers but requires you to collect and review their reports and map complementary controls. Confirm the approach with your CPA firm early, because it changes both the fee and the evidence you must gather.
Evidence already in place
Organizations that already run access reviews, change tickets, vulnerability scans and written policies spend most of their money on the examination itself. Organizations starting from scratch pay for policy writing, control design, tool configuration and remediation, often before the auditor is engaged. Inventory existing records against the criteria before requesting quotes so you can see the gap you are paying to close.
Headcount and change volume
Auditors sample from populations, so the number of joiners, leavers, access grants, production deployments and security tickets during the period sets how many items are pulled and tested. A larger, faster-changing engineering team generates more evidence to select and check. Ask how the firm plans samples for your volumes and whether it will use automated population reports.
Observation period length
A Type 1 examines controls at a single date, while a Type 2 tests operating effectiveness over an observation period. The longer the period, the more evidence accumulates and the more samples are tested, which pushes the Type 2 fee above the Type 1 fee. Decide which report your customers require before committing to a period, and ask the firm how exceptions during the period are handled, since they can extend the work.
How the budget looks for different organizations
A first-time startup usually pays for the most work per dollar of revenue because almost nothing exists yet. The company must write policies, set up access controls, configure logging and build the evidence trail before the CPA firm can test anything. Most of the spend goes to readiness and remediation rather than to the examination fee itself, and the internal time of a small engineering team is a large hidden cost. The Justice Department's regulatory analysis put Type 1 costs for small and medium businesses in a range of $15,000 to $50,000 when readiness, audit, remediation and consultant fees are included (89 FR 86116). Treat that range as a general reference, not a forecast for your company.
- Readiness work: Scoping, gap analysis and policy drafting often fall to the founders or one engineer, and outside help is an optional purchase.
- Tooling: Compliance platforms and cloud security services are recurring subscriptions that start before the first report exists.
- Single-category scope: Security alone keeps the criteria count at the 33 common criteria, which limits design and testing effort.
- Type 1 first: A point-in-time report can be a smaller first purchase, but customers may ask for a Type 2 later, which adds an observation period.
- Rework risk: Controls designed without a clear system boundary often need redesign after the first auditor conversation.
Ask any quote to separate the CPA fee, readiness help, tooling and remediation so you can see which items recur in year two.
A mid-size company that already has written policies, an identity provider, centralized logging and a change process has a different cost pattern. The main gap is usually evidence: the controls exist, but records are scattered across tickets, chat and cloud consoles. Spending shifts toward mapping existing controls to the Trust Services Criteria, collecting consistent samples and fixing a small number of gaps. The Justice Department's second set of estimates placed Type 2 costs for small and medium businesses between $30,000 and $75,000 including readiness, audit, remediation and consultant fees (89 FR 86116). Your position inside that range depends mainly on how much evidence is already automated.
- Gap analysis: A short readiness review can show whether the existing controls already cover the criteria in scope.
- Evidence automation: Recurring cost often rises when the company adds tooling to pull access reviews and change records.
- Observation period: A Type 2 report covers a period of operation, so the cost of running controls during that period is part of the budget.
- Internal time: Control owners in IT, HR and engineering spend recurring hours on reviews and sampling requests.
- Auditor familiarity: A CPA firm that has seen the company's stack may need less time for walkthroughs.
Check whether the quote assumes starting controls from scratch or building on current documentation, because that assumption moves the total more than the audit fee does.
A large or multi-product company faces cost drivers that scale with the number of systems, business units, locations and subservice organizations. Each product line can require its own system description, its own sampling and its own control owners, and the audit can take longer than a single-product audit. The Justice Department cited a Type 1 range of $50,000 to $100,000 and a Type 2 range of $75,000 to $150,000 for large businesses, including readiness, audit, remediation and consultant fees (89 FR 86116). Those figures come from vendor publications used in a federal rulemaking, so confirm current pricing with the firms you are considering.
- Scope boundaries: Deciding which products, environments and teams sit inside the report is the first cost decision, and it can be revisited.
- Multiple owners: Each control area often needs a named owner, which adds coordination and recurring review time.
- Subservice organizations: Inclusive or carve-out treatment of cloud providers changes how much testing and documentation the CPA firm performs.
- Governance tooling: Central evidence repositories and ticketing integrations are larger recurring costs at this size.
- Remediation backlog: Older systems with weak access or logging controls can add months of work before the examination begins.
Ask the CPA firm how it prices additional systems and locations, and whether a scope change after fieldwork begins results in a new fee.
A company that already holds a SOC 2 report and then adds categories or a SOC 2+ report faces incremental cost rather than a full first-time program. The common criteria stay the same, but availability adds 3 criteria, confidentiality adds 2, processing integrity adds 5 and privacy adds 18, and each addition must be designed, operated and tested (2017 TSC). Privacy is usually the largest increment because its 18 criteria touch notice, consent, retention and disclosure processes that may sit outside engineering. A SOC 2+ report that adds other frameworks adds mapping and testing work on top of that. The budget question is therefore which additional criteria your customers actually need.
- Category increments: Each added category adds criteria to the test plan, so ask the CPA firm to quote them separately.
- Process ownership: Privacy and confidentiality controls often need legal, product and customer support involvement.
- Report length: Additional categories lengthen the system description and the testing section of the report.
- Overlap savings: Controls already tested for security, such as access reviews, can often be reused, which can reduce incremental effort.
- Timing: Adding a category mid-cycle may require a bridge period or a change in the reporting window.
For each added category, ask which customer or contract requires it and whether a narrower scope would meet that need.
When cost is incurred across the SOC 2 project
The SOC 2 project moves through a fixed sequence of phases, and each phase produces a different output and is usually paid for from a different budget. Knowing the order lets you ask suppliers for costs by phase and see where internal time, tooling and external fees land.
Define scope and write the system description
Management decides which system, services, locations and trust services categories the report will cover, and writes the system description that the CPA firm will evaluate. Internal leadership and engineering usually carry most of this work, with the CPA firm or a consultant reviewing drafts if they are engaged early. The output is an agreed scope statement and a draft system description. Confirm with the CPA firm in writing that the scope it will test matches what management has described before any further spend.
Assess readiness and map controls to criteria
Someone compares the existing controls against the Trust Services Criteria for the chosen categories and records where gaps remain. This step may be done internally, by a readiness consultant, or by a firm that will not issue the report, and each option has a different cost profile. The output is a control matrix and a gap list with owners. Ask whether the readiness work is a fixed-fee deliverable with a written list of what it covers.
Remediate gaps and deploy tooling
Teams fix the gaps the readiness review found, such as missing access reviews, undocumented change approvals or incomplete logging. Engineering time, licensed tools and any infrastructure changes are the main costs here, and they are usually charged to the IT, security or product budget rather than the audit line. The output is working controls with evidence that they operate. Recurring tool subscriptions begin here and continue through the report cycle.
Collect evidence during the observation period
For a Type 2 report, controls must operate over the observation period, and evidence such as access review records, ticket trails, training completions and vulnerability scan results must be collected as it is produced. For a Type 1 report, evidence supports the control design as of the stated date. Internal staff usually own collection, and the cost is mostly their time. The output is an organized evidence library the auditor can sample from. Estimate the internal hours with your team before committing to a Type 2 window.
Complete CPA fieldwork and testing
The CPA firm performs its risk assessment, requests evidence, samples items and tests whether the controls were designed and, for Type 2, operated effectively. This is the largest external fee in most projects, and the firm sets it based on its professional judgment, scope and the volume of testing. Management responds to requests and signs the written representations the examination requires. The output is a list of test results and any exceptions, which management must address before the report is issued.
Receive the report and plan renewal
After testing, the CPA firm issues the SOC 2 report, which states its opinion as of a date or over a period. Customers and their reviewers then ask for copies, and management may need a bridge letter for any gap before the next report. Renewal recurs on the operating cycle, bringing back audit fees, evidence collection and tool subscriptions. The output is the issued report and a budget for the next cycle. Ask the firm for its renewal fee and any changes in scope in the original quote.
Why a cheap or fast SOC 2 offer should raise questions
A low fee or a promised report date is a reason to ask more questions, not fewer. In February 2026 the Journal of Accountancy advised service organizations to assess whether a SOC offer is unrealistically fast, easy or cheap, and to be wary of sales teams that lean heavily on bundled packages. The chair of the AICPA SOC 2 Working Group said at the same time that SOC professionals see signs that fast and easy offerings may come at the expense of quality and objectivity. For a buyer, the practical question is who sets the fee and what it covers. Under the AICPA Code, the fee must rest on the service auditor's professional judgment, and AICPA ethics staff wrote in April 2026 that a SOC tool provider setting or unilaterally changing the fee in a bundled package threatens compliance with ET 1.230.030. Ask any quote to name the CPA firm, the separate fee for the examination, and any amount paid to a tool or consulting provider.
A cheap quote often moves cost to later stages rather than removing it. Thin readiness work tends to surface as exceptions in the report, extra fieldwork rounds, evidence that a sample cannot support, or controls that were written but never operated during the observation period. Each of these adds time and fees, and in a Type 2 examination the period cannot be shortened after the fact. The report itself can also be rejected by a customer's vendor review team if the system description is vague or the scope leaves out a service the customer relies on. Illustrative example: a provider buys a low-cost package, learns in fieldwork that access reviews were never documented, and must restart its observation period. The savings from the first quote are then spent twice.
Before signing, request a written scope listing the Trust Services Criteria categories, the systems and locations, the subservice organizations, and the deliverables, plus the expected dates for fieldwork and report issuance. Confirm whether the quoted price includes readiness work, remediation, and any reissue of the report, and ask for the CPA firm's peer review status and license details. Treat promises of a report in days or weeks as a warning sign, and compare any quote against the published cost estimates in the Justice Department's 2024 analysis, which treat the examination fee as only one part of the total. For the AICPA's own warnings, see the Journal of Accountancy's February 2026 article on promises of fast and easy SOC offerings.
What to have in place before you ask for a quote
A CPA firm can only price a SOC 2 examination once it knows what system is being examined, which criteria apply and what evidence already exists. The four items below decide how much readiness and remediation work is left, which is where most of the cost difference between quotes comes from.
A defined system boundary
Write down the production system, the services it delivers to customers, the cloud accounts, regions and data stores that support it, and the internal teams that operate it. A boundary that says "the whole company" widens every control test, while one that names the customer-facing platform narrows it. Ask each firm to quote against the same written boundary so the figures are comparable.
The Trust Services Criteria selected
Decide which categories sit beside security: availability, confidentiality, processing integrity or privacy. Security always uses the common criteria, and each additional category adds criteria to design, operate and test. The 2017 Trust Services Criteria can be downloaded free with a free AICPA account, so read the criteria yourself before requesting quotes and note which categories your customers actually ask for.
Existing policies and control owners
Gather the security policies you already have and a named owner for each control area, such as access, change management and incident response. Quotes move sharply when policies are missing or outdated, because the firm must budget time to write, approve and roll them out before the examination starts. Owners who can explain their controls shorten fieldwork and reduce follow-up requests.
Identified evidence sources
List where proof of each control already lives: the identity provider for user lists and multi-factor settings, centralized logs, the ticketing system for change approvals and access requests, and cloud accounts for configuration history. Confirm that each source can export records for the observation period and that retention is long enough. Evidence that must be rebuilt by hand usually adds fees and internal hours.
Which cost decision fits your situation
This table compares the common ways organizations structure a SOC 2 engagement, from a first Type 1 report to a bundled platform offer. Read each row against your timeline, your customers' requirements and how much preparation work your team can absorb, because the CPA fee is only one part of the total.
| Option | When it fits | Cost tradeoff |
|---|---|---|
| Type 1 first, then Type 2 | A customer needs evidence soon but accepts a point-in-time report now, with a longer observation period planned afterward. | Two examinations are paid for over time, but the first report can arrive sooner and surfaces control gaps before the Type 2 period starts. Ask the CPA firm how fees differ for each stage. |
| Type 2 directly | The customer or bank expects operating effectiveness over a period and the team can hold controls steady long enough to be tested. | One examination fee, but readiness and remediation must be complete before the observation window opens. Gaps found late can delay the report and add cost. |
| In-house preparation with CPA examination only | A team with strong security and compliance skills, time to write policies and gather evidence, and a clear scope. | Internal staff time is the main cost and is hard to see on an invoice. The CPA fee is paid to the independent firm that issues the report. |
| Outsourced readiness with a separate CPA firm | The organization lacks in-house experience, needs an outside view of gaps, or must meet a deadline with limited staff. | Readiness fees are added to the CPA fee, but remediation tends to be more focused. Confirm in writing that the readiness provider is not the firm issuing the report, which affects independence. |
| Bundled compliance platform offer | The buyer wants software, policies and an auditor from one vendor and is comparing it with a stand-alone CPA engagement. | Bundles can look cheaper on the surface. The AICPA's guidance warns that the tool provider must not set or unilaterally change the CPA fee, so request the fee and the independent auditor's name in writing. |
What usually inflates the SOC 2 bill
Most overruns on a SOC 2 examination do not come from the CPA firm's fee alone. They come from decisions made late, gaps discovered too close to fieldwork, and work that was never priced because nobody owned it. Each card below names one of these drivers and the step that keeps it contained.
Scope expanded late
Adding availability, confidentiality, processing integrity or privacy after the readiness work has started means new criteria must be designed, operated and tested. The 33 common criteria apply to every SOC 2, but each added category brings its own criteria, so a late addition can reopen work already signed off. Before engagement, fix the system boundary, the categories and the subservice organizations in writing, and ask the CPA firm to confirm the scope it will test.
Gaps found during readiness
A readiness assessment that uncovers missing policies, untested backups or unreviewed access can turn a few weeks of work into a remediation project. Remediation then costs consultant hours, engineering time and sometimes a delayed observation window for Type 2. Run a gap assessment against the criteria early, with the CPA firm's expectations in mind, and assign an owner and a date to every gap before the examination period opens.
Evidence reconstructed by hand
When access reviews, change approvals and onboarding records were never captured at the time they happened, staff must rebuild them from email and chat for the auditor's sample requests. That work is paid for twice: once in internal hours and again in extra fieldwork when the auditor cannot tie the records to a date. Ask which evidence the auditor samples, and set up recurring collection so each control produces its record automatically in the system where the work happens.
Bundled tooling without a line item
Some offers combine a compliance platform, a readiness package and the examination into one price, which makes it hard to see what the CPA firm charges for the examination itself. The AICPA's ethics staff have said the fee must rest on the service auditor's judgment, and a tool provider setting or changing that fee in a bundle raises a compliance concern. Request separate quotes for the examination fee, readiness support, tooling subscriptions and any consultant hours, and confirm each one in writing.
Internal staff time underestimated
The examination consumes engineering, operations, HR and management time for interviews, evidence pulls, system description drafting and reviews of the auditor's requests. Organizations often budget only for the external fee and discover that their most senior engineers are the bottleneck for months. Estimate internal hours by control owner before signing, name a single program lead with time protected for the work, and ask the CPA firm for its evidence request list so owners can plan around it.
SOC 2 cost questions buyers ask
What is the minimum cost to get a SOC 2 report?
No supplied source sets a minimum, and the lowest figure depends on the firm, the scope and whether you need a Type 1 or Type 2. The fee is set by the CPA firm performing the examination, based on its professional judgment, so the only reliable number is a written quote for your system. Ask the firm to separate its examination fee from readiness help, tooling and any consultant. A lower examination fee can still leave you paying more later if your controls are not ready, because remediation and re-testing are usually the larger variable. Treat a very cheap or very fast offer as a reason to check its scope carefully.
What did the Justice Department estimate for SOC 2 costs?
In its October 2024 proposed rule on US sensitive personal data, the Justice Department cited vendor-published estimates of $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2 audit. A second set of estimates, which includes readiness assessment, audit, remediation and consultant fees, put Type 1 at $15,000 to $50,000 for small and medium businesses and $50,000 to $100,000 for large ones, and Type 2 at $30,000 to $75,000 and $75,000 to $150,000 respectively. The rule's analysis is a regulatory estimate built from vendor sources, not a price list, so use it as a range to test your own quote against. The same analysis summarized annual audit costs for CCPA, GDPR and SOC 2 compliance as ranging from $3,000 to $150,000 depending on audit type and firm size.
Does a SOC 2 Type 2 report always cost more than Type 1?
Usually, but not always, and the difference comes from the testing period rather than from the report label. A Type 1 report tests whether controls are designed suitably as of a date, while a Type 2 report adds testing of operating effectiveness over a period, which means more samples, more evidence and more auditor time. The published estimates cited by the Justice Department place Type 2 above Type 1 in both sets of figures. A Type 2 can still cost less than a poorly prepared Type 1 if the Type 1 needs heavy remediation first. Ask the firm how many samples it will test and over what period, since those choices drive the hours.
Can we prepare for SOC 2 ourselves to lower the cost?
Often yes, for the parts you own: policies, access reviews, change records, vendor reviews and evidence collection. Internal staff time is a real cost even when no invoice arrives, and it recurs through the year. Independence rules also matter. If the CPA firm that will issue the report helps design controls, its independence can be questioned, so separate the preparation work from the examination. Many organizations keep ownership of controls in house and hire an outside party for readiness testing or gap analysis. Confirm with your chosen firm which preparation work it can and cannot do before you start.
What should a SOC 2 quote include?
A useful quote states the scope in writing before the fee is set. Ask for:
- The trust services categories included beyond security, and the number of criteria each adds
- Whether the report is a Type 1 or Type 2, and the observation period for Type 2
- The number of systems, locations and subservice organizations covered, and whether carve-out or inclusive treatment applies
- The examination fee, any additional fees for re-testing or scope changes, and what triggers them
- Whether readiness, tooling, consultant time or penetration testing are included or billed separately
- The timing of fieldwork and report issuance, and the deliverables you will receive
Price is only comparable when the scope is the same. Ask every bidder for the same written scope.
Who issues the SOC 2 report, and does DeployOpen?
Only an independent CPA firm can issue a SOC 2 report, after examining your system and controls under AICPA attestation standards. The organization owns its controls and its system description, and the CPA firm forms the opinion. DeployOpen does not publish prices, does not issue audit reports, attestations or certifications, and does not act as the examiner. DeployOpen can plan, implement and document self-hosted open-source platforms inside your own infrastructure, prepare systems and evidence for the examination, and run security testing that feeds it. Scope, deliverables and timelines are agreed in writing before work starts, and a quote follows from that written scope. Confirm the CPA firm's license and AICPA peer review status yourself before engaging it.
How DeployOpen scopes and prepares SOC 2 evidence
DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, including their cloud accounts, data centers or air-gapped networks, and prepares the systems, controls and evidence that a CPA firm will test for a SOC 2. The work that moves the cost number most is agreed before anyone configures anything: which system and services are in the description, which trust services categories are added to security, and which production environments, access paths and subservice organizations sit inside the boundary. Engagements are fixed-scope, so scope, deliverables and timelines are written down and agreed before work starts, and a quote follows from that written scope rather than from a standard package.
Within that scope, the preparation typically covers the components that drive CPA hours: access and identity configuration, logging and monitoring, change management workflows, backup and recovery settings, and the records that show each control operated over the period, such as access review exports, joiner and leaver tickets and deployment approvals. DeployOpen can document how each platform is configured and operated so that the system description and control matrix match what the auditor will sample. Ask any implementation partner to state in the statement of work which artifacts it will produce, who keeps them after handover, and which items remain with your own staff, because internal time is a cost whether or not an outside party is involved.
Only the independent CPA firm issues the SOC 2 report, and it decides its own fee, procedures and opinion. DeployOpen does not issue audit reports, attestations or certifications, and its preparation work does not change the CPA firm's independence obligations. Confirm early whether the CPA firm you have chosen accepts evidence prepared by an outside implementer and what it asks to see. No outcome, opinion date or report acceptance by a customer is guaranteed by DeployOpen, and the written scope should say so plainly.
