Your first enterprise customer asked for SOC 2. Here's the AWS part.
A compliance platform will give you policies and a dashboard full of red. Somebody still has to turn on the logging, lock down access and prove backups restore. That's the part we do.
Type I vs Type II for a ten-person startup.
A Type I report says your controls were designed properly on one date. A Type II report says they actually worked over a period, commonly 3 to 12 months. Three months is a common market practice for a first Type II, not an AICPA rule.
Most startups get a Type I to unblock the first deal, then start the Type II observation window straight away. If a raise is coming too, the same controls answer half of what investors ask in Series A technical due diligence. Ask the customer which one their procurement team needs before you pay for either; sometimes a completed security questionnaire and a Type I letter are enough for the first year.
AWS is SOC 2 compliant. Your account isn't, yet.
AWS's own SOC reports cover their data centres and the services they run. They don't cover who has access to your account, how your databases are encrypted, whether you'd notice a stranger logging in, or whether your backups restore. Auditors test those things in your account, and most early-stage accounts fail a few of them.
The AWS controls your auditor will look at.
| Control | What "done" looks like on AWS |
|---|---|
| Access | IAM Identity Center with MFA for every person; no IAM users with passwords; root locked away with MFA |
| Access reviews | A quarterly review of who has what, with the evidence saved |
| Audit logging | An organisation-wide CloudTrail trail to a locked-down S3 bucket in a separate account |
| Threat detection | GuardDuty on in every account and region you use, alerts routed to a person |
| Configuration | AWS Config or Security Hub rules for the basics: public buckets, unencrypted volumes, open security groups |
| Encryption | KMS encryption on databases, volumes and buckets; TLS everywhere traffic leaves a VPC |
| Change management | Infrastructure in Terraform, reviewed pull requests, protected main branch, deploys only from CI |
| Backups and recovery | AWS Backup policies, retention that matches your policy document, and a dated restore test |
| Vulnerability management | Image and dependency scanning in CI, patching with tickets that get closed |
| Vendor and data flows | A diagram of where customer data goes, which your policies can point to |
Not an exhaustive list of the Trust Services Criteria; it's the infrastructure slice that usually needs engineering time.
Vendor estimates, not quotes. Ranges are wide because auditors and scope vary.
What SOC 2 costs a startup, US and UK.
| Item | US | UK |
|---|---|---|
| Type I audit fee | $5k to $20k | £8k to £70k |
| Type II audit fee | $15k to $50k | £15k to £120k+ |
| Year one, all in | often $25k to $80k | £24k to £88k |
| Compliance platform | Usually a yearly subscription, priced separately by the vendor | |
| Our infrastructure package | from $5,900, one AWS organisation and one main application | |
Sources: StartupDefense (US), SureCloud (UK). SOC 2 isn't a UK legal requirement, but US buyers often expect it from UK vendors.
What we deliver, and what we don't.
From $5,900 for one AWS organisation and one main application, fixed before we start:
- A gap review of the controls above against your account, in the first week
- Everything on the checklist built, in Terraform, through pull requests
- Evidence wired into Vanta, Drata or Secureframe, so the dashboard turns green for real
- A short runbook per control, so the evidence keeps coming after we leave
We don't write your HR policies, run the audit, or promise a clean report. An independent CPA firm performs the examination; we prepare the systems it tests. If you want the controls kept in shape between audits, the Scale plan on the fractional DevOps page covers it.