What is SOC 2 readiness?
SOC 2 is a US-originated security certification that evaluates whether your organisation's systems and processes adequately protect customer data. It's assessed against five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Most companies pursue SOC 2 Type II, which covers a 6–12 month observation period demonstrating that controls are working consistently over time.
SOC 2 readiness means implementing the technical and procedural controls that an auditor will look for. On the technical side: access logging, encryption at rest and in transit, change management through version control, monitoring and alerting, and incident response procedures. On the process side: vendor risk assessment, employee security training records, and documented policies.
Building the controls is distinct from the audit itself. The external audit — carried out by an accredited CPA firm — is a separate engagement, typically costing $20,000–$50,000 AUD. This build cost covers the technical implementation only.
When does your app need it?
- US enterprise customers are requiring SOC 2 Type II as a condition of signing — it's increasingly a procurement standard
- You're in a sales cycle where a prospect's security team has asked for a compliance report
- You're preparing for significant revenue growth and want to remove compliance as a blocker
- Your application handles sensitive customer data at scale and you want formal validation of your controls
- Investors are asking about your compliance posture as part of due diligence
- You already have good security practices but lack the documentation and evidence to prove it
How much does it cost?
Building SOC 2 readiness controls typically adds 13–27 hours of development — roughly $2,000–$6,000 AUD.
Lower end: Implementing the core technical controls (detailed below) with existing tooling: structured access logging, encryption configuration review, MFA enforcement, alerting on suspicious events, and setting up a compliance platform to automate evidence collection.
Higher end: A full controls gap assessment against all five Trust Service Criteria, implementing missing technical controls, configuring automated evidence collection (Vanta, Drata, or Secureframe), documenting change management processes, setting up vulnerability scanning and patch management workflows, and supporting the initial audit process.
How it's typically built
Compliance automation platforms are the practical path to SOC 2. Vanta, Drata, and Secureframe connect to your AWS/GCP/Azure account, GitHub, identity provider, and other tools, and automatically collect the evidence an auditor needs — access logs, configuration screenshots, policy acknowledgements — reducing the manual burden significantly.
The core technical controls fall into several categories. Access management: every user has a unique account, MFA is enforced on all production systems, and access is reviewed quarterly. Encryption: data at rest (database encryption, encrypted EBS/S3) and in transit (TLS 1.2+ everywhere, HSTS headers). Monitoring: CloudTrail or equivalent capturing all API calls, alerting on failed logins, privilege escalation, and unusual access patterns. Change management: all code changes go through pull requests with review, deployments are logged.
Incident response requires a documented procedure (not just a good intention) — who is paged, who declares an incident, how it's communicated to affected customers, and how the post-mortem is recorded.
Questions to ask your developer
- Which Trust Service Criteria are you pursuing? Security is mandatory; the others are optional. More criteria means more controls and longer audit time.
- Are you using a compliance automation platform? Vanta/Drata/Secureframe significantly reduce the ongoing evidence collection burden — factor in their cost ($10,000–$30,000/year) alongside the build cost.
- Have you done a gap assessment? Knowing which controls you already have vs which need to be built prevents surprises mid-audit.
- What does your access review process look like? SOC 2 requires quarterly (or better) reviews of who has access to what — this needs to be a real operational process.
- Is your incident response procedure written down and tested? "We'd figure it out" is not an auditable control.
See also: Security audit and pen test · GDPR and privacy compliance · High availability · App cost calculator