How to Get SOC 2 Certified: 6 Steps to Your Attestation Report

The Crucial Terminology Truth: Attestation, Not Certification

If you are searching for how to get "SOC 2 certified," you are in the right place—but the first and most critical lesson you must learn is that there is no such thing as a SOC 2 certification. The American Institute of Certified Public Accountants (AICPA), which authors and governs the SOC 2 standard, does not issue certificates, does not certify service organizations, and does not maintain a public directory of certified vendors.

Instead, the formal outcome of a successful SOC 2 examination is an independent attestation report issued by a licensed Certified Public Accountant (CPA) firm under SSAE 18 (AT-C Section 205). In this report, an independent auditor evaluates your internal controls against specific Trust Services Criteria and issues a formal professional opinion on whether your system description is fairly presented and whether your security controls were suitably designed (in a Type 1 audit) and operated effectively over time (in a Type 2 audit).

Enterprise buyers, CISOs, and vendor risk assessors understand this distinction intimately. When enterprise procurement asks whether you have "SOC 2," they do not expect a certificate; they expect a confidential 50-to-120-page attestation report delivered under a Non-Disclosure Agreement (NDA). Understanding this from day one prevents embarrassing missteps during enterprise sales conversations and aligns your team with how real audits are evaluated.

The 6-Step Roadmap: From Zero to Your SOC 2 Report

Achieving your first SOC 2 attestation report requires navigating six structured, sequential steps. Following this proven roadmap ensures your engineering team remains focused on shipping product while methodically satisfying AICPA criteria.

Step 1: Define Your Audit Scope and Trust Services Criteria

The first step is establishing clear boundaries around what will and will not be audited. The AICPA outlines five Trust Services Criteria: Security (the Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy.

The Golden Rule for Startups: Scope exclusively to Security for your initial audit. Security is mandatory for every SOC 2 report and contains all 22 foundational controls (CC1.1 through CC9.2). Unless an enterprise customer contract specifically obligates you to include Availability (system uptime SLAs) or Confidentiality (strict data segregation), adding optional criteria will needlessly inflate your audit fees and evidence requirements. Read our full breakdown of criteria in What is SOC 2?.

Step 2: Conduct an Internal Gap Assessment

Before hiring an audit firm or purchasing expensive compliance software, conduct a comprehensive gap analysis to determine where your current infrastructure, tools, and processes diverge from AICPA standards.

Evaluate your startup across the 47 standard control parameters using our free, browser-only SOC 2 Readiness Assessment and download the SOC 2 Controls Checklist. This exercise will generate your prioritized remediation backlog—identifying whether you lack background checks for contractors, need automated branch protection on GitHub, or need to configure centralized audit logging in AWS.

Step 3: Implement Security Controls and Formalize Policies

Remediation consists of two parallel tracks: technical configurations and administrative policies:

• Technical Safeguards: Enforce multi-factor authentication (MFA) across all identity providers (Google Workspace, Okta) and developer portals (AWS, GitHub). Deploy Mobile Device Management (MDM) to ensure all staff laptops enforce disk encryption (FileVault/BitLocker). Enforce automated pull request approvals in CI/CD.
• Administrative Documentation: Formally adopt 12 to 18 baseline security policies, including Access Control, Change Management, Incident Response, Disaster Recovery, Vendor Risk Management, and Information Classification. Require all staff to acknowledge these policies.
• Third-Party Penetration Test: Commission an independent security firm to conduct a gray-box web application penetration test to satisfy Common Criteria CC7.1.

Step 4: Select and Vet an Independent Licensed CPA Firm

Only an accredited, independent CPA firm can conduct the audit. Interview at least two to three specialized technology CPA firms. Inquire about their experience auditing cloud-native stacks (AWS, Kubernetes, Terraform) and request fixed-fee proposals. See detailed selection criteria in the next section.

Step 5: Execute the Observation Period and Auditor Fieldwork

If pursuing a Type 1 audit, the CPA firm evaluates your controls as of a single calendar day. If pursuing a Type 2 audit, you enter an observation period (typically 3 to 6 months) during which controls must operate continuously.

Once the observation window closes, auditor fieldwork commences. The CPA firm requests population files for code changes, employee onboarding/offboarding, and access reviews, then pulls statistical samples to inspect evidence artifacts. See timeline guidance in How Long Does SOC 2 Take?.

Step 6: Review Draft Findings, Address Exceptions & Receive Your Report

Following fieldwork, the auditor delivers a draft report. Review Section IV carefully for any noted "Test Exceptions." If an exception occurred (e.g. one contractor offboarded late), draft a clear management response explaining the root cause, confirming no unauthorized access occurred, and outlining preventive measures implemented since.

Once finalized, management executes Section II (Management Assertion), and the CPA firm partner affixes their signature to Section I, delivering your official, confidential SOC 2 attestation report.

Choosing the Right Auditor: 4 Non-Negotiable Criteria

Your choice of audit firm directly impacts your audit experience, your budget, and whether enterprise procurement teams accept your final deliverable without friction.

Implementation Approaches: DIY vs. Automation Software vs. Consultants

There are three primary operational pathways to prepare for your SOC 2 audit. Each carries distinct financial, engineering, and timeline trade-offs:

For an objective comparison of leading compliance platforms, explore our in-depth reviews of Vanta Alternatives and Vanta vs Drata.

Pre-Audit Readiness Checklist: What Auditors Inspect

Before authorizing your CPA firm to initiate formal testing, verify that you have assembled clean, dated populations for these core evidence categories:

• Personnel Populations: Master spreadsheet of all full-time employees and contractors hired or terminated during the audit period, cross-referenced with background check completion dates and policy acknowledgment timestamps.
• Change Management Populations: Export of all production pull requests merged during the observation window, confirming that every PR received at least one peer approval prior to merge.
• Access Review Records: Documented, signed tickets from engineering leadership confirming quarterly reviews of AWS IAM roles, GitHub repository permissions, and production database accounts.
• Vulnerability Management Logs: Automated weekly container and dependency vulnerability scan reports, accompanied by Jira/linear tickets showing critical findings resolved within policy SLAs.
• Penetration Test Report: Formal, signed third-party web application penetration test report dated within the preceding 12 months, accompanied by documented remediation evidence.

The Auditor Independence Rule: Why Consultants Cannot Audit Themselves

A critical regulatory trap that catches many first-time founders is the AICPA Independence Rule (codified in the AICPA Code of Professional Conduct, Section 1.200).

Under US auditing standards, an auditor must maintain absolute financial, advisory, and operational independence from the organization being examined. Specifically, an audit firm cannot design, implement, or maintain the internal controls that they subsequently examine.

Be wary of vendors or consultants offering an "all-in-one" package where the same agency writes your security policies, configures your AWS firewall rules, and issues your SOC 2 attestation report. Under AICPA rules, this is an illegal conflict of interest. If an enterprise customer’s risk team discovers an independence violation, the report is deemed void, forcing your company to restart the audit with a new CPA firm.

Your compliance software vendor (e.g. Vanta, Drata) or external security consultant acts as your readiness partner; your independent CPA firm must remain at arm's length as your examiner.

Fieldwork Walkthrough: 5 Common Auditor Interview Questions

During fieldwork, the CPA firm conducts brief technical walkthrough interviews with your engineering leads. Auditors are not looking to trick you; they want to verify that what is written in your policies reflects actual daily engineering behavior:

1. "Walk me through how a code change travels from a developer’s laptop to production."
   What the auditor wants to hear: "A developer creates a feature branch, commits code, and opens a pull request on GitHub. Automated CI status checks run linting and unit tests. At least one designated senior engineer reviews and approves the PR. The code is merged to main and automatically deployed to production via our GitHub Actions deployment pipeline without manual server access."
2. "Show me how system access is revoked when an employee departs."
   What the auditor wants to hear: "When HR records a departure in our HRIS, an automated webhook triggers our Okta/Google Workspace Identity Provider to suspend the user account within 1 hour. This instantly revokes SSO access across AWS, GitHub, Slack, and all connected SaaS tools. We log a departure ticket verifying account suspension."
3. "How do you detect and respond to an unauthorized access attempt in AWS?"
   What the auditor wants to hear: "AWS CloudTrail streams API logs to Amazon GuardDuty and Datadog. If an unauthorized API call or root login occurs, an automated PagerDuty alert notifies our on-call security engineer, who executes our documented Incident Response Playbook."
4. "How do you vet third-party vendors who store customer data?"
   What the auditor wants to hear: "Before adopting any new subprocessor (e.g. Datadog, Stripe), our security team conducts a vendor risk assessment, verifies that the vendor holds a current SOC 2 Type 2 or ISO 27001 certificate, and executes a formal Data Processing Agreement (DPA) with Standard Contractual Clauses."
5. "Show me evidence of your most recent database restoration drill."
   What the auditor wants to hear: "Our RDS Postgres databases create automated daily snapshots replicated across regions. Once per quarter, our DevOps lead executes an automated restoration drill to a sandbox environment, logs the Recovery Time Objective (RTO) and Recovery Point Objective (RPO), and files a signed recovery ticket."