Ask five people what a SOC 2 audit costs and you will get five confident answers that differ by a factor of ten. The reason is not that anyone is wrong. It is that “the audit” means different things to different people. To a finance partner, it is the invoice from the audit firm. To an engineering manager, it is the three weeks when nobody ships because everyone is pulling screenshots. To a security lead, it is a year-round program that happens to produce a report.
This post is a practical guide to what these audits cost a mid-sized company, meaning roughly 200 to 500 employees, a handful of platform engineers, and a security function that is a person or a small team. It separates the visible costs (the fees you can quote) from the hidden ones (the hours you cannot), shows where the evidence work concentrates, explains the difference between point-in-time and continuous compliance monitoring, and gives you a checklist for evaluating tools without buying a promise. You will finish with a cost model you can fill in with your own numbers, and a clear idea of which spending reduces future audit work and which merely moves it around.
A note on numbers. Published ranges vary widely, many come from vendors who sell compliance tooling, and your own quote depends on scope, auditor, and maturity. We cite ranges so you have orientation, not so you can budget from them. Treat them as directional.
Two frameworks, two cost shapes
SOC 2 is an attestation report issued by an independent CPA firm. It evaluates the design (Type I) or the design and operating effectiveness over a period (Type II) of your controls against the Trust Services Criteria. Security is mandatory; availability, confidentiality, processing integrity, and privacy are optional. The report is typically renewed every year. If you need the basics first, see what is SOC 2 compliance.
ISO/IEC 27001 is a certification of an information security management system (ISMS) issued by an accredited certification body. It has an initial two-stage audit, annual surveillance audits, and a full recertification every three years. Our introduction to ISO 27001 for AWS, Azure, and GCP covers the structure.
The cost shapes differ in a way that matters for planning:
| SOC 2 | ISO 27001 | |
|---|---|---|
| Output | Attestation report (Type I or II) | Certificate |
| Cadence | Annual report, observation window for Type II | Three-year cycle with annual surveillance audits |
| Auditor | CPA firm | Accredited certification body |
| Where the effort concentrates | Evidence that controls operated across a period | Establishing and maintaining a management system, risk treatment, documentation |
| Typical recurring pattern | Same effort each year | Heavy first year, lighter surveillance years, a bigger recertification in year three |
Many companies pursue both, because customers ask for one or the other. The good news is that the overlap in underlying controls is large. The bad news is that treating them as two projects doubles the evidence work.
What the published ranges say
These figures are from practitioner and vendor sources published in 2026. They disagree, because the audiences and assumptions differ.
- One practitioner breakdown puts a first SOC 2 Type II audit for a 50 to 100 person SaaS company at roughly $30,000 to $100,000, depending on scope, auditor tier, and automation (Scrut).
- Another puts the all-in first-year figure at $30,000 to $150,000 once readiness work, tooling, and internal labor are counted alongside the auditor’s fee (Konfirmity).
- A snapshot of 172 attestation-capable firms found Type II fees spanning from about $15,500 to $200,000, depending on firm tier and scope (Compyl).
- For ISO 27001, a cost guide describes the three-year cycle as surveillance audits in years one and two at roughly $5,000 to $15,000 each, and a recertification audit in year three of $10,000 to $35,000 or more (Sprinto).
- Another analysis argues that the certification audit is often only 20 to 30 percent of the total cost, with the rest being readiness, tooling, and internal time (heyData).
Content was rephrased for compliance with licensing restrictions.
Two lessons follow. First, the same company can fairly receive quotes that differ by several multiples. Second, almost every source agrees on the structural point: the audit fee is not the budget.
The five cost buckets
Use these buckets to build your own estimate. Fill in numbers from quotes and from your own time records.
1. Auditor or certification body fees
The invoice. It scales with headcount, the number of in-scope systems, the number of criteria or controls, and the auditor’s tier. It is also the only line item you can negotiate directly. Ask for fixed-fee quotes that state what triggers extra charges, such as additional sampling, re-testing, or scope changes.
2. Readiness and advisory
A gap assessment, policy drafting, control design, and sometimes a mock audit. Valuable the first time. Questionable every year after, unless the program has changed substantially.
3. Tooling
Compliance automation platforms, vulnerability scanners, endpoint management, security awareness training, penetration testing, log retention, and background checks. Be careful here: tooling often appears in the budget as a single line but is really three different things. Tools that collect evidence, tools that implement controls, and tools that track tasks. Only the first two reduce real risk or real hours. The third is useful but is not a control.
4. Internal labor
The largest and least visible bucket. Include time from the compliance owner, platform and DevOps engineers, IT, HR, legal, and executives. Most companies do not track it, so they underestimate it by a wide margin.
5. Remediation
Findings from the gap assessment or the audit that require work: enabling MFA everywhere, removing shared accounts, writing missing procedures, fixing logging gaps, or closing a vendor review. Remediation is money you would arguably spend anyway for security, but it lands in the audit budget.
A worked example (illustrative only)
Replace every number below with your own. The structure matters more than the values.
| Role | Hours per audit cycle | Notes |
|---|---|---|
| Compliance or security owner | 320 | Evidence coordination, auditor communication, policy upkeep |
| Platform / DevOps engineers (3) | 120 (3 × 40) | Pulling access lists, change records, logs, configuration evidence |
| IT and HR | 40 | Onboarding and offboarding records, background checks, training |
| Engineering managers | 20 | Access reviews, risk review sign-offs |
| Executives | 20 | Management review, risk acceptance |
| Total | 520 hours |
At an assumed blended loaded cost of $80 per hour, that is $41,600 in internal labor, before the auditor’s fee, tooling, or remediation. The number is invented, but the pattern is common: for many mid-sized companies, the internal hours rival or exceed the auditor’s invoice. That is why the best cost lever is almost always reducing recurring hours, not shaving the audit fee.
Where the evidence work hides
An audit, whatever the framework, boils down to this question asked many ways: show me that the control you described actually happened, for this sample, in this period. The hours go into answering it. These are the areas where the work tends to concentrate.
Access control and reviews. Who had access to production and why? When were access reviews done and what changed? How quickly were leavers removed? If the answer comes from a spreadsheet that someone rebuilds each quarter, it is among the most expensive evidence in the audit. Standing privilege makes it worse, because every standing entitlement has to be justified; time-boxed access produces its own record. We cover this in eliminating standing cloud access for SOC 2 and ISO 27001.
Change management. Evidence that changes were reviewed and approved before deployment. Good source: your version control and CI system, if approvals are enforced and logged. Bad source: a ticket someone updates afterwards.
Logging and monitoring. Proof that logs exist, are retained, are protected from tampering, and are reviewed. Auditors want to see alerts and responses, not just storage.
Vulnerability and patch management. Scan results, remediation timelines against your own policy, and exceptions with approvals.
Asset inventory and configuration baselines. An accurate list of systems in scope and evidence they match your hardening standard.
Vendor management. Due diligence records for subprocessors, and evidence that reviews recur.
Data protection. Encryption settings, who can query sensitive data, and records of what they did. For companies handling personal data, this area is growing in importance; query-level records answer “who accessed what” far better than connection logs do.
People controls. Background checks, training completion, policy acknowledgments.
Each of these has a cheap path (the system produces evidence as a by-product) and an expensive path (a person reconstructs it afterwards). Your cost is largely the difference between the two.
Point-in-time versus continuous compliance monitoring
The traditional audit rhythm is point-in-time: prepare, collect evidence, sample, report, relax. The weakness is obvious. Between audits, controls drift. An engineer widens a security group, a log retention setting is changed, a leaver keeps access. You discover it when the next audit sample finds it, and by then the finding is a deficiency in a report.
Continuous compliance monitoring turns the same controls into a standing check. At its best it does five things:
- Maps checks to controls. Each configuration or access check is tied to the framework requirement it supports, so a failing check tells you which control is at risk.
- Detects drift as it happens. A new public bucket or an account without MFA creates an alert and a ticket, not a surprise in nine months.
- Preserves history. You can show the state of a control on a specific date and how long it was out of compliance, which is exactly what Type II operating-effectiveness testing asks.
- Records exceptions properly. Risk acceptances with an owner, a reason, and an expiry, not a verbal agreement.
- Exports evidence in a form auditors accept. Not a screenshot folder.
What it does not do is equally important. Monitoring cannot write your policies, decide your risk appetite, interview your staff, or replace the auditor’s judgment. It also cannot turn a weak control into a strong one; it can only prove whichever you have.
The tooling trap
A frequent and costly mistake is buying a platform that tracks compliance tasks and concludes that compliance is solved. A task tracker tells you that someone ticked “access review completed.” It does not tell you whether the access review was meaningful, whether the underlying access is still excessive, or whether a new standing admin appeared yesterday. Ask of every tool: does it observe the real state of my systems, or does it observe what people told it?
How to evaluate compliance monitoring tools
| Question | What a good answer looks like |
|---|---|
| Where does the evidence come from? | Direct, read-only connections to your cloud, identity provider, code platform, and databases; not manual uploads |
| Does it cover the controls where your hours go? | Access, change, logging, vulnerability, and data access, not only policy documents |
| Can it show history? | Point-in-time state on a given date, with trend |
| How does it handle multiple frameworks? | One control, many framework mappings, so evidence is reused |
| Who holds the data? | Clear answer on residency, retention, and who can read it |
| What does it cost as you grow? | Pricing that does not penalize adding accounts, users, or repositories excessively |
| Can an auditor use the output directly? | Exports your auditor has accepted in practice |
| What does it not do? | A candid list; be wary of anyone who says “nothing” |
Ten ways to reduce cost without cutting corners
- Scope tightly and deliberately. Include only the systems that serve customers in scope. Every extra system multiplies evidence.
- Choose the right report first. A Type I may unblock a deal faster, but if buyers will ask for Type II anyway, plan the observation window early to avoid paying twice.
- Run SOC 2 and ISO 27001 from one control set. Map once, test once.
- Replace manual evidence with system-generated evidence. If a control can produce its own record, let it.
- Remove standing access. Fewer permanent entitlements means fewer things to review and justify.
- Enforce approvals in tooling. Branch protection and required reviews produce change evidence for free.
- Automate access reviews from real data. Start from live entitlements, not an exported spreadsheet.
- Fix recurring findings at the source. A finding that repeats each year is a process problem, not an audit problem.
- Negotiate the audit. Ask for fixed-fee quotes, multi-year pricing, and a combined fieldwork pass if one firm covers both frameworks.
- Time-box the fire drill. Set an internal evidence freeze date before fieldwork, so late changes do not create rework.
Where Cloudanix fits
Cloudanix contributes on the parts of the audit where the evidence is hardest to reconstruct: cloud posture, who has access and why, and who touched sensitive data.
- Continuous cloud posture mapped to frameworks. Cloudanix CSPM checks cloud configuration against the frameworks you care about and keeps the history, so you can show a control’s state over time and export evidence for your auditor. Our guide to passing SOC 2, ISO 27001, and GDPR audits across multiple clouds shows the approach.
- Access evidence as a by-product. Cloud JIT and Database JIT replace standing privileges with requested, approved, time-boxed access, and every request, approval, session, and revocation is recorded against a named identity. When an auditor asks who had production access last quarter and why, the answer is a filtered view, not a rebuild.
- Query-level evidence for the data tier. Database Activity Monitoring records every statement, who ran it, and what it touched, in storage you control, and can mask and block at the query layer. That moves data-access evidence from connection logs to a record that answers the real question.
- Identity and entitlement visibility. CIEM surfaces unused permissions, stale keys, and over-privileged identities, which are among the most common access findings.
To be clear about limits: Cloudanix does not write your policies, replace your auditor, or cover people and process controls such as HR checks. It reduces the hours spent on the technical evidence, which for many teams is the largest recurring block.
A 90-day plan to lower next year’s audit cost
Days 1 to 30: measure. Record actual internal hours for your last audit, by role. Identify the five evidence requests that took the longest. That list is your target.
Days 31 to 60: automate the expensive five. For each, pick a system-generated source and connect it. Typical candidates are access lists from the identity provider, cloud configuration state, change approvals from version control, vulnerability scan results, and database access records.
Days 61 to 90: remove the cause. Where an evidence request is painful because the control is weak, such as permanent admin access or shared database logins, fix the control, not the paperwork. Then set the evidence freeze date and the exception process for the next cycle.
Closing thought
An audit is a forcing function. It asks, at a regular interval, whether the things you say about your security are true, and it charges you in proportion to how hard that is to prove. Organizations that treat it as a yearly scramble pay in hours and stress. Organizations that treat it as the output of systems that already behave well pay once, to build the systems, and then much less.
If you would like to see how much of your technical evidence can come from the systems you already run, talk to us. We will walk through your last audit’s longest requests and show which ones can become by-products.
Related Resources
- Passing SOC 2, ISO 27001 & GDPR Audits on Multi-Cloud GCP + Azure
- Cloud Security for Financial Services: Compliance, JIT Access & Misconfig Playbook
- Eliminating Standing Cloud Access to Satisfy SOC 2 and ISO 27001
- What Is SOC 2 Compliance? The Complete Guide for B2B SaaS Companies
- What is AWS CloudTrail? Complete Guide to AWS Audit and Governance
- Query-Level Audit Evidence for ISO 27001 and SOC 2 on Aurora MySQL
- Cloudanix Compliance
