Framework Guide · SOC 2
SOC 2 (Service Organization Control 2)
The trust report enterprise buyers ask for before they sign.
Who needs it: SaaS vendors, MSPs, and any B2B company that stores customer data — especially when selling to mid-market or enterprise.
Overview
SOC 2 is an AICPA attestation covering how you handle customer data across five Trust Services Criteria. A Type 1 covers design of controls; Type 2 covers their operation over a 3-12 month window.
Timeline
3–6 months to Type 1, plus a 3–12 month observation window for Type 2.
Typical cost
$25k–$80k typical: auditor fees, prep work, and tooling.
What it covers
How Scarlet Risk helps
Policy generator
Draft SOC 2-aligned policies in minutes, not weeks.
Evidence tracking
Continuous monitoring against Trust Services Criteria.
Auditor-ready reports
Board-Ready and Compliance Predictor reports on demand.
Frequently asked
Do I need Type 1 or Type 2?
Type 1 proves your controls are designed correctly at a point in time. Type 2 proves they operated effectively over a window — usually 6–12 months. Most enterprise buyers require Type 2, but Type 1 unblocks early deals.
How long does SOC 2 take for a small team?
A prepared 20-person SaaS company can be Type 1 ready in 8–12 weeks. Type 2 adds the observation window.
Does Scarlet Risk replace an auditor?
No — the audit itself is performed by a licensed CPA firm. Scarlet Risk handles the prep, evidence, monitoring, and reporting the auditor needs.
What's the difference between SOC 2 and ISO 27001?
SOC 2 is US-centric and control-focused. ISO 27001 is international and requires a documented Information Security Management System (ISMS). Many companies pursuing global deals do both.
Ready to shortcut SOC 2?
Scarlet Comply and our on-demand reports collapse months of prep into hours.