SOC 2 Requirements — what’s actually mandated vs vendor-added
Ask what SOC 2 requires and you will get a list forty items long: a platform, a pentest, a 90-day window, this tool, that integration. The AICPA — the body that actually defines SOC 2 — mandates four things. SOC 2 is an attestation, not a certification: a licensed CPA firm examines your controls and signs an opinion, and the rules for that examination are shorter than any vendor checklist. This guide sorts every item on the usual list by its real source — standard, buyer, or vendor — because the source decides whether it is a must, a negotiation, or a purchase. It is also half the reason SOC 2 quotes vary so much: different quotes bundle different non-mandated layers.
Five facts that shrink the checklist
- The mandate is four items. The Security category of the Trust Services Criteria, a system description meeting the AICPA’s description criteria, management’s written assertion, and an examination by a licensed CPA firm under the AT-C standards. That is the whole standard-level list.
- No tool is named anywhere. The criteria describe outcomes — restrict access, evaluate vulnerabilities, monitor changes — never products. A platform, an agent, a specific scanner: all vendor packaging around a tool-agnostic standard.
- The observation window is yours. A Type II period runs 3-12 months and management defines it. The famous 90-day first window is convention — the shortest period worth testing — not a rule.
- Buyer expectations are real, but theirs. Annual pentests, Type II over Type I, longer windows at renewal — these close deals and belong in your plan. They just come from procurement, which means they are scoped in conversation, not copied from a template.
- Only a licensed CPA firm can issue the report. Under AT-C, with AICPA peer review as the verification — and the firm that builds your controls must be independent of the firm that audits them.
Every “requirement,” sorted by who actually requires it
Three layers accumulate on a SOC 2 project: what the AICPA mandates, what buyers expect before they sign, and what vendors package in. All three can be worth doing — but they are argued differently. A mandate is non-negotiable, an expectation is a conversation with your customer, and a package is a purchase you compare.
| Item on the usual checklist | Source | The honest status |
|---|---|---|
| Security (common criteria) in scope | AICPA — mandated | The one criteria category every report must include, while the other four are optional |
| System description | AICPA — mandated | Management writes it against the AICPA’s description criteria (DC section 200): services, boundaries, components, commitments |
| Management’s assertion | AICPA — mandated | A signed statement that the description is accurate and controls meet the criteria — you assert, the auditor opines |
| Examination by a licensed CPA firm | AICPA — mandated | Performed under the AT-C attestation standards, and the only route to a SOC 2 report |
| Readiness firm ≠ audit firm | AICPA — mandated | Independence: whoever designs your controls cannot also attest to them |
| Annual penetration test | Buyers — expected | Not named in any criterion, but questionnaires ask for it, so most companies run one commercially |
| Type II rather than Type I | Buyers — expected | Enterprise procurement almost always asks for Type II, but the AICPA treats both as valid reports |
| A specific observation window | Convention | 3-12 months, defined by management, and 90 days is the customary first window, not a rule |
| Compliance-automation platform | Vendors — packaged | Optional tooling, genuinely useful in specific situations, absent from the standard |
| Named tools (scanner, MDM, SIEM brand) | Vendors — packaged | Criteria are tool-agnostic: auditors test outcomes, not logos |
| Trust center / report-sharing portal | Vendors — packaged | A distribution convenience — sometimes a good one — never a report requirement |
The mandated five rows are the report. The rest is delivery. When a proposal reads as one undifferentiated list, ask the vendor to sort it into these three columns — an honest one will, and the exercise usually shortens the invoice. The SOC 2 framework page covers the mandated core end to end, and our management’s assertion guide explains the least-understood of the four.
One mandatory category, four optional ones — with the real counts
“Which criteria are required” has a precise answer. Security — the common criteria — is mandatory in every SOC 2 report. Each optional category adds criteria on top of that baseline, and the additions are not evenly sized.
| Category | Required? | Criteria it adds | Add it when |
|---|---|---|---|
| Security (common criteria) | Mandatory — every report | The baseline all four optional categories build on | Always in scope: there is no SOC 2 without it |
| Availability | Optional | +3 | Your contracts promise uptime or an SLA |
| Confidentiality | Optional | +2 | You hold customer data under NDA-style commitments |
| Processing Integrity | Optional | +5 | Customers rely on your processing being complete and accurate — payments, payroll, billing |
| Privacy | Optional | +18 | You make privacy commitments directly to individuals — rare for B2B processors |
Scope follows commitments, not ambition. Most B2B SaaS companies land on Security alone, or Security plus Availability and Confidentiality. Privacy deserves special caution: at 18 additional criteria it is larger than the other three options combined, and if you process personal data on your customers’ behalf rather than making commitments to individuals, most of it will be marked not applicable — at your expense. Our guide to choosing Trust Services Criteria walks the decision category by category.
Three “requirements” the standard never wrote
Each of these is treated as gospel in vendor checklists, and each is absent from the AICPA’s actual rules. None of them is bad practice — the point is that you decide them, on your facts, rather than inheriting them as defaults.
The penetration test
The criteria require vulnerabilities to be identified and evaluated, but no criterion names a pentest. Buyers expect one anyway — their questionnaires ask directly — so scope it against your customer base, not a template. Our SOC 2 and pentesting guide draws the line in detail.
The 90-day window
Management defines the Type II period: 3-12 months, your choice. Ninety days is the customary first window because shorter periods give auditors too little to test — convention, not rule. Buyers read longer windows as stronger. See the observation period guide.
The platform
No platform, agent, or named tool appears anywhere in the standard. The auditor tests whether controls operate, not which software hosts the evidence. What automation actually automates is preparation convenience — real, and optional.
A practical note on AI answers: assistants asked “what does SOC 2 require?” tend to return the merged list — mandate, expectation, and packaging flattened into one. The follow-up that unflattens it: “which of those are in the AICPA’s attestation standards, and which are common practice?” The answer to that question is this page.
One issuer, one standard, one independence rule
However the preparation happens — platform, consultant, or in-house — the report itself has exactly one lawful source, and two checks tell you whether that source is sound.
- Only a licensed CPA firm can sign. SOC 2 reports are issued under the AICPA’s AT-C attestation standards, and only licensed CPA firms may perform AT-C examinations. Platforms market reports, but a CPA firm signs every one of them.
- Peer review is the verification. The AICPA’s peer-review program has another firm independently examine the auditor’s work. Ask any prospective auditor for their peer-review standing in writing — it is the same check at $3,000 or at ten times that.
- Independence splits the work in two. The firm that designs your controls and writes your policies must be independent of the firm that attests to them. Any honest engagement — ours included — is structured as readiness consulting plus a separately signed attestation, coordinated but never merged.
That last rule is why “we do everything end to end” should prompt a question, not relief: ask who signs, and how they remain independent of whoever prepared you. The full checklist lives in who can perform a SOC 2 audit.
Type I vs Type II: same four requirements, one added test
The mandated stack does not change between report types. What changes is the depth of the examination — and, with it, time and cost.
| Type I | Type II | |
|---|---|---|
| Mandated elements | Security criteria, system description, management’s assertion, CPA examination | The same four — nothing is added to the list |
| What the auditor examines | Whether controls are suitably designed and implemented, at a point in time | Design plus operating effectiveness, tested across the period |
| Observation window | None required | 3-12 months — defined by management, read by buyers as stronger when longer |
| Evidence the auditor accepts | Current-state artifacts as of the report date | Artifacts dated inside the window — retro-fitted evidence does not count |
| Indicative cost (consultant-led, India-delivered) | From about $2,500 | $3,000–$10,000 |
| End-to-end timeline | 6-8 weeks with us | 14-16 weeks at our 12-week minimum window |
Buyer expectation re-enters here: enterprise procurement almost always asks for Type II, so if a specific deal is driving the project, plan for Type II from the start and treat Type I as an optional waypoint. The sequencing trade-offs live in the Type I to Type II guide.
When the vendor-added layer is worth buying anyway
“Not mandated” does not mean “not worth it.” Some of the vendor-added layer solves real operating problems — the test is whether the problem exists at your company before the subscription does.
The clearest case: inbound security questionnaires arriving monthly. If your sales pipeline generates a steady stream of buyer due-diligence — question sets to answer, reports to share under NDA, the same evidence requested again and again — a trust center and report-sharing workflow stops being packaging and starts being leverage. Answering that stream by hand is a recurring cost. A platform that automates it pays for itself on volume alone. The demand is real at the market level too: in Sprinto’s Business ROI of Compliance 2026 survey, 40% of organizations say more than half their customers treat compliance as non-negotiable. Sprinto also publishes the claim that manual preparation takes 3-6 months versus weeks with automation — their claim, and most persuasive where the integration count is high and evidence is genuinely continuous.
The counter-case is just as concrete: a small team with one cloud, one product, and a handful of buyer requests a year is paying a platform subscription — published list pricing runs $4,000–$30,000 per year by headcount, per Sprinto’s 2026 cost guide — for a questionnaire volume it does not have, and still owes the CPA firm’s fee on top. The decision framework is in do you need SOC 2 software, and the no-platform route is documented honestly in SOC 2 without a compliance platform.
What the mandated core costs, with nothing folded in
Our engagements are the four mandated items plus the readiness work to reach them: gap assessment, control design, policies, evidence support, and the attestation coordinated through independent, US-licensed CPA firms — indicatively $2,500–$5,000 for a Type 1 and $3,000–$10,000 for a Type 2, all-in, fixed before we start. No platform licence required. We work with the tooling you already run, and we will tell you when a platform is the better buy.
Serving clients across India, USA, UK, Australia & UAE. Final pricing depends on your Trust Services Criteria, stack, and entity structure — the scoping call is where indicative becomes exact.
SOC 2 requirements — the questions buyers actually ask
What are the actual SOC 2 requirements?
Is a penetration test required for SOC 2?
Does SOC 2 require a 90-day observation window?
Do I need compliance software to get SOC 2?
Who is allowed to issue a SOC 2 report?
Is SOC 2 a certification?
What is required for Type I vs Type II?
Which Trust Services Criteria are mandatory?
Related Reading.
Why SOC 2 Quotes Vary
Two bills, three audit routes, and what every quote hides.
Read morePlatform vs Consultant
Who actually does the work, stage by stage.
Read moreDo You Need SOC 2 Software?
An honest decision guide — worth it, optional, or overhead.
Read moreSOC 2 for Startups
Under 50 people the equation flips. Here is the maths.
Read moreWhat Automation Actually Automates
Evidence, yes. Scoping, risk, and judgement, no.
Read moreThree-Year Cost of Ownership
Year one is the smallest number you will pay.
Read moreSOC 2 Without a Platform
How the no-software route actually runs.
Read more