SOC attestation, explained and executed without the runaround.
There's no such thing as a "SOC certificate" — a CPA attests that your systems and controls are in place. We do the preparation work so that attestation goes smoothly the first time.
SOC 2, answered directly
By Joe Engelking, CEO. Updated October 2026.
What is SOC 2?
SOC 2 is a report from an independent CPA firm on how a service organization protects customer data. It evaluates your controls against criteria for security and, optionally, availability, processing integrity, confidentiality, and privacy. It is an attestation, not a certificate, and customers often ask to see it.
Who needs a SOC 2 report?
Service providers whose customers need proof of real security controls, such as software companies, data processors, and IT providers. No law requires it. Customers and large prospects ask for it during vendor reviews, and without one a deal can stall in a security questionnaire.
What do SOC 2 auditors actually look at?
Auditors look at your written policies, access controls, device and network monitoring, change management, vendor management, incident response, and staff training, along with evidence that you follow them. For a Type 2 report, they test that the controls worked consistently over a period of months.
How should a small company prepare for SOC 2?
Write down your policies, enroll devices in monitoring, require multifactor authentication, train staff and keep records, test your backups and recovery plan, and set up alerting for signs of a breach. A readiness review first shows the gaps, so the audit itself goes smoothly.
| Control area | What the auditor wants to see | What has to be in place |
|---|---|---|
| Device monitoring | Every device is managed and watched | Endpoint detection and response on all devices |
| Staff training and policies | Documented training and a policy handbook | Training completed with records |
| Breach controls | Controls that prevent and contain an incident | Access controls and a response process |
| Sensitive data | Extra protection for personal, financial, and customer data | Encryption and limited access |
| Recovery | A plan to restore service after an outage | A documented, tested disaster recovery plan |
What is a SOC 3 report?
A SOC 3 report is the general-use version of a SOC 2. It covers the same trust services criteria but with less detail, so it can be shared publicly, for example on a website or in a sales proposal. The full SOC 2 report is usually shared with customers and prospects under an NDA. An independent CPA firm issues both, and we help you build the controls and evidence that either report depends on.
What is the difference between SOC 1 and SOC 2?
SOC 1 reports on controls that affect a customer’s financial reporting, so it is common for payroll, billing, and similar service providers. SOC 2 reports on controls for security and, optionally, availability, processing integrity, confidentiality, and privacy, which is what technology and data-handling providers usually need. Which one you need depends on what your customers are asking for.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report describes whether your controls are designed properly at a single point in time. A Type 2 report tests whether they worked over a period of time, typically several months. Customers usually ask for Type 2 because it shows the controls operate consistently, and many companies get a Type 1 first as a milestone.
How long does SOC 2 compliance take?
It depends on where your controls and documentation start. Writing policies and closing gaps comes first, and a Type 2 report then requires an observation period before the auditor can report. We map the timeline after a readiness assessment instead of quoting a generic number.
We prepare you; a CPA attests.
Controls & policy handbook
We build the policies and procedures your SOC attestation actually requires, in a handbook your team can follow.
Type 1 to Type 2
We get you through your initial Type 1 attestation, then manage the roughly 6-month period of adherence needed for Type 2.
Trusted CPA pairing
We pair you with a CPA we know and trust, and tell you exactly what they'll expect from you going in.
What SOC auditors actually want to see.
- Device monitoring & EDR
- Documented staff training & policy handbook
- Breach controls in place
- Extra protection for PII, financial & customer data
- A disaster recovery plan
- Alerting for signs of a breach
A SOC 2 attestation is essentially a cybersecurity audit.
Vendors and partners ask for SOC compliance because it proves your security controls are real, not just claimed. We know what auditors look for and build straight toward it — realistic deadlines, managed start to finish, without the overkill some firms sell you.
Real businesses, real relationships.
“When Joe assigned Ivan as our lead, we felt like we finally had IT solved. Ivan has been with us 24×7 and the team behind him makes sure nothing falls through the cracks.”
“We’ve been using LME Services for our business IT support, and the experience has been fantastic. Their cybersecurity expertise, responsiveness, and ability to explain complex tech in plain English really set them apart.”
SOC 2, step by step
- Scope. Pick the systems in scope and the trust services criteria your customers care about. Security is required. Availability, confidentiality, processing integrity, and privacy are optional.
- Readiness assessment. Compare your current controls and policies with the criteria and list the gaps in priority order.
- Fix the gaps. Written policies, access controls and multi-factor sign-in, device management, backups, monitoring, vendor reviews, onboarding and offboarding steps, and security training.
- Collect evidence. Logs, tickets, training records, and access reviews, organized so the auditor can find what they ask for.
- Choose the report. Type 1 looks at your controls at a point in time. Type 2 tests that they worked over an observation period, commonly several months.
- Audit. An independent CPA firm performs the attestation. We coordinate and answer requests with you.
- Report and maintain. The report is renewed on a regular cycle, and the controls have to keep running between audits.
In 2022 we took a corporate services client through a SOC 2 project in about three months. Every company starts from a different place, so we give you a timeline after a readiness assessment.
| Topic | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| What it covers | Controls that affect a customer’s financial reporting | Security and, optionally, availability, processing integrity, confidentiality, and privacy | The same criteria as SOC 2, in a shorter report |
| Who typically asks | Payroll, billing, and similar service providers’ customers | Customers of software, data, and IT providers | Anyone, since it is meant to be public |
| How it is shared | Usually under an NDA | Usually under an NDA | Can be posted publicly |
| Who issues it | An independent CPA firm | An independent CPA firm | An independent CPA firm |
What affects the cost of SOC 2
- How many systems, people, and vendors are in scope
- Which trust services criteria you choose
- Type 1 or Type 2, and how long the observation period is
- How many gaps the readiness assessment finds
- The auditor’s fee, which you pay to the CPA firm and not to us
We quote our work after the readiness assessment. Related: HIPAA compliance, ISO compliance, IT and cybersecurity assessment, and compliance for regulated industries.
Common questions
Type 1 is a one-time attestation of your policies and controls at a point in time. Type 2 requires you to adhere to those controls for roughly 6 months before a CPA can attest to that ongoing performance — you need Type 1 before you can pursue Type 2.
No — a SOC report is an attestation performed by an AICPA-certified CPA, not a certificate issued after a scan. We prepare your controls and documentation, then connect you with a CPA we trust to perform the attestation.
Type 1 can move relatively quickly once your controls are documented. Type 2 requires roughly 6 months of adherence before the CPA can attest — the earlier you start, the more time you have to fix issues before they show up in the report.
No — an independent CPA performs the attestation, as required. We build the controls, policies, and evidence beforehand so that attestation goes smoothly.
Your competitors are already using AI. Every week you wait, they pull further ahead.
While your team spends hours on email, quotes, scheduling and follow-up, the business down the street is letting AI handle the busywork. The AI Quick-Win Assessment shows you where AI will pay off in your business, which tools are safe for your data, and what to switch on first.
Example only: 5 hours a week for 48 weeks at $40 an hour. Your results depend on your team, tasks and tools. We estimate the numbers with you and never guarantee savings.
A 45-minute conversation about where your hours and dollars go: email, quotes, scheduling, follow-up and reporting.
A short report with quick wins ranked by impact and effort, real tool prices, estimated hours saved and the risks to avoid.
A 30-minute review call and a four-day starting plan, about 10 to 15 minutes a day. We can set it up for you or train your team.
Questions about your IT? Call 847-496-5196 or get a free IT assessment.
See how this fits into our full Compliance & Regulated Industry IT Guide, organized by industry: healthcare, legal, finance, non-profit, and manufacturing.
See the Full Guide