SOC 2 vs CIS Controls: which to pursue first and when to do both
If a buyer or regulator asks for security evidence and you must choose a starting point, the short answer is this: CIS Controls Implementation Group 1 is a control baseline with no certificate, and SOC 2 is a CPA report that customers request. IG1 gives you 56 foundational safeguards to implement and verify, while a SOC 2 gives a buyer an independent auditor's opinion on your controls. Start with IG1 when your controls are immature and you need a defensible, prioritized plan. Start with a SOC 2 when a named customer is already asking for an attestation and your controls are ready to be tested.
Pursue a SOC 2 first when a sales deal or renewal is blocked on a report, and your system boundary, policies and evidence are already in place. Pursue IG1 first when you do not yet know which controls are operating, because the safeguards tell you what to fix before an examiner tests it. Doing both makes sense for a growing service company that will need a Type 2 report over time, since IG1 gives the control set the examination will test. CIS's v8.1 mapping in the CIS Controls Navigator links Safeguard 1.1 and Safeguard 1.2 to SOC 2 criteria, so you can see where an IG1 safeguard lands in the trust services criteria. Confirm the current mapping in the Navigator before relying on it, because the Navigator is the source that defines it.
The mapping is useful for planning but it does not replace the CPA examination. A CIS-to-SOC 2 crosswalk shows that a safeguard is relevant to a criterion. It does not show that your system description is accurate, that your controls were designed for your scope, or that they operated over a period. Only a CPA firm can issue a SOC 2 report, and the firm sets its own fee based on its professional judgment. Ask any auditor you approach how they will use CIS mappings, and confirm with them which evidence they will accept for each criterion.
Where IG1 safeguards overlap with SOC 2 criteria
CIS publishes a mapping in the Controls Navigator that links v8.1 safeguards to SOC 2 criteria. The links below show where one body of evidence may serve both a CIS assessment and a SOC 2 examination. A mapping identifies overlap only, so each card names what to verify before reuse.
Safeguard 1.1 and CC3.2
The Navigator links Safeguard 1.1 to SOC 2 criterion CC3.2, which concerns identifying and assessing risks to objectives. Safeguard 1.1 asks you to maintain an accurate inventory of enterprise assets, so the asset list can support the risk identification your auditor will test. Check that the inventory your IG1 work produces is dated, owned and reviewed on a schedule, because a Type 2 examination looks for that operating over a period.
Safeguard 1.1 and CC6.1
The same safeguard also links to CC6.1, which covers logical access controls over systems and data. An asset inventory feeds the access review because you cannot restrict access to systems you have not listed. Confirm with your CPA firm which systems fall inside the system description, since assets outside that boundary will not count toward the criterion even if they appear in your CIS inventory.
Safeguard 1.2 and CC7.1
Safeguard 1.2 links to CC7.1, which concerns detecting and monitoring for new vulnerabilities and configuration changes. The unauthorized-asset handling that IG1 asks for gives you a concrete event your monitoring should catch. Ask your auditor how they expect detection evidence to look, such as alert records or tickets, since a mapping does not specify the form.
Reuse evidence, not conclusions
A mapping shows where evidence may be reused. Completing an IG1 safeguard does not by itself satisfy a SOC 2 criterion, because the auditor tests design and, for Type 2, operating effectiveness against the Trust Services Criteria and your own control descriptions. Treat each mapped safeguard as a starting point for evidence collection and document how your controls meet the criterion in your own words.
No certification from CIS or NIST
CIS publishes the Navigator mapping, and NIST has its own informative references, but neither body certifies an organization or endorses a mapping as proof of compliance. The only attestation a SOC 2 produces comes from a CPA firm. Ask any consultant who offers a CIS or NIST badge for the basis of that claim, and ask your CPA firm whether it will accept the mapping as a reference in its testing plan.
Confirm the mapping version
The mapping cited here belongs to the v8.1 Navigator. If your team works from an earlier CIS Controls version, the safeguard numbers and their mappings may differ, so the overlap you rely on may not hold. Confirm the version your IG1 program uses, then confirm the SOC 2 criteria list with your auditor against the current AICPA Trust Services Criteria before finalizing your control matrix.
Who assesses each framework and what they issue
The CIS Controls are assessed by your own organization. Nobody external signs a report on your behalf, and the output is an internal measure of how far each Safeguard is implemented. CIS provides CIS-hosted CSAT, which it describes as free to every organization for non-commercial use in assessing its own implementation of the CIS Controls. The Controls themselves are free for any organization to use to improve its own cybersecurity, but commercial use of the content requires CIS's prior approval, so check that rule before you build a product or service around it.
- Measurement reference: The CIS Controls Assessment Specification defines, for each Safeguard, the inputs, operations, measures and metrics used to verify it is implemented. CIS states that it covers what to measure, not how, so your team still designs the method.
- Scope of the output: The result is an internal maturity picture by Safeguard, Implementation Group and asset class. It is not a certificate for your organization.
- Accreditation is different: CIS Controls Accreditation applies to service providers that deliver CIS Controls services, and accredited organizations are listed on the CIS website. Using a provider's accreditation does not make your own environment assessed.
- Licensing check: Commercial use of the Controls content requires prior approval from CIS under its Creative Commons license terms.
Before relying on a CSAT result in front of a customer, confirm with your legal team whether the internal use terms cover how you intend to share it.
A SOC 2 is performed by a CPA firm acting as the service auditor. It is an assertion-based examination under AT-C section 205 of the AICPA attestation standards, which requires the service auditor to obtain written representations from management. Management prepares the system description, asserts that the controls are suitable and, for a Type 2, operating effectively, and the auditor expresses an opinion on that assertion against the Trust Services Criteria.
- Type 1 report: Covers the system description and the suitability of control design as of a specific date.
- Type 2 report: Adds an opinion on operating effectiveness over a period, so buyers usually read it as stronger evidence of day-to-day control operation.
- Management representations: The auditor relies on written statements from management, so the organization carries responsibility for their accuracy.
- Fee setting: The fee is set by the CPA firm that performs the examination, based on the service auditor's professional judgment. AICPA ethics staff stated in April 2026 that a SOC tool provider setting or unilaterally changing the fee in a bundled package threatens compliance with the AICPA Code.
- Use restrictions: A SOC 2 report is generally restricted in use, unlike a SOC 3 general use report.
Ask the CPA firm to confirm the report type, the period covered and who may receive the report before you commit to a timeline.
What a SOC 2 report shows that an IG1 baseline does not
An IG1 baseline tells you which safeguards to build. A SOC 2 report tells a buyer what an independent CPA examined and found. The two answer different questions, and a team that completes IG1 has not yet produced anything a customer can file. A SOC 2 examination begins with management's description of the system, prepared against the AICPA's 2018 description criteria, and then tests the Trust Services Criteria the service organization chose to include. Security is always in scope through the common criteria CC1 to CC9. The criteria themselves are the 2017 TSC, read with the points of focus revised in 2022. Those points of focus are characteristics that help design and evaluate controls, not separate requirements, so the auditor judges whether the controls you described fit the system you actually run.
The report comes in two forms, and the form changes what you must have in place before the fieldwork starts. A Type 1 report covers the system description and the suitability of control design as of a single date, so it can be issued once the design is ready. A Type 2 report adds an opinion on operating effectiveness over a period, which means the auditor samples evidence that each control ran throughout that period. Ask your CPA firm which type a buyer needs and what observation window it expects. Also confirm that the examination is assertion-based under AT-C section 205, which means management signs written representations, so the description must match reality before anyone signs.
Distribution is the other difference. A SOC 2 report is generally restricted in use, so you share it under NDA with customers and prospects who need it. A SOC 3 covers the same categories in less detail and is a general use report that can be freely distributed, which suits a public trust page but not a detailed security review. Finally, CIS states that its Controls do not replace any regulatory, compliance or authorization scheme. Use IG1 to build the safeguards, then plan the SOC 2 scope, observation window and report audience with a CPA, and check with the CPA which mapped criteria your customers will read.
What a SOC 2 audit costs and what drives the bill
The biggest cost difference between these two paths is that a SOC 2 bill is an invoice from a CPA firm, while CIS Controls costs are mostly your own staff time. The Justice Department's regulatory analysis for its October 2024 proposed rule on U.S. sensitive personal data (89 FR 86116) cited estimates, drawn from vendor publications, of $5,000 to $25,000 for a SOC 2 Type 1 and $30,000 to $100,000 for a Type 2. Treat those figures as a dated external reference point, not a quote. The fee is set by the CPA firm performing the examination, and AICPA ethics staff have said it must rest on the service auditor's professional judgment, so ask each firm for a fee built from its own scope.
A SOC 2 quote has several components. The CPA firm's fee covers the examination itself and is typically paid once per report period. Internal staff time for evidence collection, system description writing and auditor walkthroughs is often the larger hidden cost. Tooling for evidence capture and access reviews is usually a recurring subscription. Remediation of gaps found before or during the audit can add engineering work. The number of trust services categories in scope also matters: security alone uses the common criteria, while availability, processing integrity, confidentiality and privacy each add criteria only when you include them. Ask the firm to state the categories, the Type 1 or Type 2 period, the sample sizes and whether a readiness review is included or billed separately.
CIS Controls costs look different. The Controls are free to use for improving your own cybersecurity, and CIS says its hosted self-assessment tool, CSAT, is free for non-commercial assessment of your own implementation, so the main outlay is internal effort to build the Implementation Group 1 inventory, configure safeguards and collect measurements. Confirm the license position for your use case with CIS before relying on it, since the Controls use a Creative Commons NonCommercial license and commercial use needs prior approval. If you hire a consultant, quote the work as a fixed scope covering the 56 IG1 Safeguards, the evidence you expect at the end and whether the consultant will support a later SOC 2 audit. An outside assessor is optional for CIS, so a quote should separate advisory fees from any assessment fee.
Sequencing IG1 and a SOC 2 without duplicating evidence
The sequence builds one set of controls and one body of evidence that serves both the CIS Controls baseline and the SOC 2 examination, so the CPA firm tests work you have already documented rather than a parallel set of records.
Adopt IG1 as the control baseline
Leadership names an owner for the baseline and agrees that the 56 IG1 Safeguards are the starting point, since CIS describes IG1 as essential cyber hygiene and a minimum standard for every enterprise. The security lead assigns each Safeguard to a named owner and records the current state of each one. The step is done when every IG1 Safeguard has an owner, a status and a written note of gaps, approved by the executive who will answer to the buyer for security controls.
Map Safeguards to SOC 2 criteria
Use the CIS Controls Navigator for v8.1 to read the mappings that link IG1 Safeguards to SOC 2 criteria. For example, the Navigator links Safeguard 1.1 to SOC 2 CC3.2 and CC6.1, and Safeguard 1.2 to SOC 2 CC7.1. Confirm each link against the current Navigator and your own system, because a mapping shows where two frameworks point to similar controls, not that a control satisfies a criterion. The output is a single register that lists each control once, with its Safeguard reference and its criteria references, so one piece of evidence can answer both.
Define the system boundary and TSC categories
Management writes the system description that the SOC 2 will cover, including the infrastructure, software, people, procedures and data inside the boundary, and lists the systems that feed or depend on it. Security is always in scope through the common criteria CC1 to CC9, so the team decides whether availability, processing integrity, confidentiality or privacy also apply based on what customers have asked for. The step closes when the boundary and category choice are written down and the description is drafted against the AICPA description criteria.
Run an internal readiness review
An internal reviewer or an independent advisor checks the register against the system description and tests whether each control operates as written. Consultants can help prepare evidence and close gaps, but the review must not be treated as the examination. Findings are logged with an owner and a fix date. The step is done when every in-scope criterion has a control, an evidence source and a result, and the open items are either closed or accepted by management in writing.
Choose Type 1 or Type 2 from buyer requests
A Type 1 report covers the system description and the suitability of control design as of a date, while a Type 2 report adds an opinion on operating effectiveness over a period. Review the security questionnaires and contracts your buyers send, and record which report type each one asks for. Ask the CPA firm how the observation window and sample evidence will be handled for your environment. The decision is recorded in writing so the evidence collection starts on the right basis.
Schedule the examination with a CPA firm
Select a CPA firm that performs SOC 2 examinations, and ask it for a written engagement letter that states the scope, the report type, the period and the fee basis. The fee is set by the firm, based on its professional judgment, so compare written quotes rather than accepting a fee set by a tool vendor. Management signs the written representations the examination requires. The step is done when the engagement letter is signed and the evidence calendar is agreed.
Hand over the shared evidence set
Provide the CPA firm with the single control register and the evidence library built in the earlier steps, with a clear index showing which evidence supports which criterion and which Safeguard. Keep CIS Controls assessment records separate from the audit file only where the auditor asks for it. The CPA firm issues the opinion; the consultant does not. The step closes when the auditor confirms the evidence set is complete for the scope and the opinion is issued by the firm.
Common questions before hiring help for SOC 2 or CIS Controls
Can our team implement CIS Controls Implementation Group 1 without outside help?
Often yes, if you have someone who owns security outcomes and time to work through the list. CIS describes IG1 as essential cyber hygiene and a minimum standard for every enterprise, covering 56 foundational Safeguards aimed at the most common attacks. The CIS Controls Navigator maps each Safeguard to other frameworks, so you can see where one piece of work supports a SOC 2 criterion. Outside help becomes more useful when no one on staff has time to collect evidence for each Safeguard, or when you need an independent view of whether the controls work as described. Use the CIS Controls Assessment Specification to define what you will measure for each Safeguard before you start.
How long does a SOC 2 Type 2 observation period run?
The observation period is set by the scope you agree with your CPA firm, not by a fixed figure in the framework. A Type 1 report covers the system description and the design of controls as of a single date. A Type 2 report adds an opinion on whether controls operated effectively across a period, so the length of that period, and how much evidence the auditor samples across it, drives both timing and cost. Ask the firm to state the period, the sampling approach and the evidence they will request before you commit. Controls that were not operating consistently at the start of the period usually extend the work.
What does a SOC 2 or CIS Controls project need from engineering, legal and operations?
Each group carries a different share of the work:
- Engineering configures access controls, logging, change management and vulnerability processes, and produces the screenshots, tickets and logs that show them running.
- Legal reviews customer commitments, the system description and the scope of any report you will share.
- Operations owns onboarding and offboarding, vendor reviews, incident handling and the recurring reviews that auditors and assessors sample.
The CIS Controls Assessment Specification defines the inputs and measures for each Safeguard, which gives engineering a concrete checklist. Name an owner for each control before work begins, because missing evidence is the most common reason a Type 2 period drags.
Does CIS Controls Accreditation apply to our organization?
Probably not, unless you provide CIS Controls implementation, auditing or assessment services to others. CIS describes Accreditation as an organization-level stamp of approval for service providers, and accredited organizations are listed on the CIS website and may use the CIS Controls Accredited badge. It is run with CREST and accredits CIS SecureSuite member organizations that deliver those services. CIS lists an application fee of $1,500 for CREST members and $2,500 for non-members. If you only want to show your own customers that you use the Controls, a SOC 2 report or your own CIS self-assessment is the more relevant evidence. Confirm the current terms with CIS before you assume either way.
What drives the cost of a SOC 2 audit up or down?
The CPA firm sets the fee based on its professional judgment, so the price depends on the engagement, not on a published rate. The Justice Department's October 2024 proposed rule on U.S. sensitive personal data cited vendor-sourced estimates of $5,000 to $25,000 for a Type 1 audit and $30,000 to $100,000 for a Type 2 audit. Those are illustrative of a range, not a quote for your environment. Scope is the main driver: the number of systems, the trust services categories beyond security, the number of locations and the length of the period. Readiness work you do before the auditor arrives lowers the hours they need. Ask each firm for a written fee tied to a stated scope and sampling approach, and compare the same scope across quotes.
Can CIS Controls work count as evidence for a SOC 2 audit?
It can support the audit, but it does not replace it. The CIS Controls Navigator for v8.1 links several Safeguards to SOC 2 criteria, for example Safeguard 1.1 to CC3.2 and CC6.1, and Safeguard 1.2 to CC7.1. Those links show where the same control may produce evidence for both, which reduces duplicate work. The auditor still tests the controls you put in scope, against the criteria you selected, and the report is an opinion on your controls, not on your CIS implementation. Confirm with your auditor which evidence they will accept and how they will sample it. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme.
Does DeployOpen help prepare for SOC 2 and CIS Controls work, and how is it scoped?
DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications, and independent CPA firms perform SOC 2 examinations. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ongoing support and continuous testing are available as retainers. DeployOpen does not publish a price list, so a quote follows from the written scope. Ask for the control list you want covered, the systems in scope and the evidence the auditor expects, then compare that scope with your internal capacity.
How DeployOpen scopes IG1 and SOC 2 readiness
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports or certifications, so the independent CPA firm that performs your SOC 2 examination remains the source of that opinion.
How we scope
- Written scope agreed before work starts, listing which IG1 Safeguards and which SOC 2 criteria are in play.
- Confirmation of the SOC 2 report type, Type 1 or Type 2, and the examination period your buyers expect.
- Identification of the systems, cloud accounts and data stores that fall inside the system description.
How we build
- Mapping of your existing controls to IG1 Safeguards and the CIS-published links to SOC 2 criteria, with gaps recorded.
- Implementation of the missing technical controls on your own infrastructure, such as access, logging and backup configuration.
- Testing of each control against its intended measure so evidence exists before the auditor's fieldwork begins.
How we hand over
- A control register linking each Safeguard and criterion to its configuration, owner and evidence location.
- Runbooks and procedures written for your staff so the controls keep operating after the engagement closes.
- A handover session that walks your team and auditor through the evidence package and open items.
How we support
- Fixed-scope engagements with deliverables and timelines agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing available as a retainer once the baseline is in place.
- Quotes follow from the written scope, so ask us to itemize any Type 2 observation period support separately.
