SOC 2 readiness assessment: what it is and what it costs

A customer, an investor, or your own plan says you will need a SOC 2 report, and someone told you to start with a “readiness assessment.” You would like to know what that is, what it costs, and how much of it you can do yourself before you pay anyone.

That is this guide. One limit first: a readiness assessment is not an audit, and nothing in it, or in anything we sell, is a SOC 2 report. Only a CPA firm issues a report. We do readiness and documentation work only; we never audit or attest. This guide is general information, not legal advice.

What a readiness assessment is

A readiness assessment is a review you do before an audit. Someone compares what your company does, and what it has written down, with the SOC 2 Trust Services Criteria, and lists where the two don’t match. The list of gaps is the product, usually with a plan to close them. Our plain-English guide to the criteria covers what the criteria are.

As we read it, “readiness assessment” is a market term, not the name of a standard deliverable. Some sellers in the cost section below price it as one line with a “gap analysis”; others treat the two as separate. So the first question to any seller is what you would actually get back.

Who can do one:

• You, alone. The section on what you can do yourself is how we would start.
• A compliance software platform. Platforms that track controls often include a self-assessment in the subscription. It checks what the tool can see; it can’t see a process nobody wrote down.
• A consultant. They review your controls and documents and write up the gaps: an outside view from someone who has done it before.
• The CPA firm that will examine you. Some firms offer readiness work ahead of their audit. If yours does, ask how it keeps its readiness advice separate from its audit judgment.

What it is not

• It is not a SOC 2 report. A report is a CPA firm’s opinion after an examination. A readiness assessment is a list of findings, and no customer can treat it as a report.
• It does not mean you will pass. It tells you what you know today. Controls still have to be run, and a Type 2 report covers a period, so records of that period have to exist. Our guide on whether you need SOC 2 yet explains the two types.
• It is not something to quote to a customer as a status. “SOC 2 compliant” and “SOC 2 ready” are phrases to keep out of an email or a sales page unless a CPA firm’s report backs them. Write what is true: “We have not been examined. Our written policies are attached.”

What it costs elsewhere

We don’t sell a readiness assessment, so we have no price to compare. These are the figures other companies publish. We read each page on 2026-10-11. We haven’t checked any figure, and every source sells compliance software or services, so treat them as direction, not quotes.

• Vanta says a readiness assessment starts around $10,000 and scales with company size, and that you can run one in house or bring in a consultant.
• Thoropass says these reviews typically run from $0, if you do them internally, to $25,000 for a consultant-led assessment. Its example of an early-stage software startup with 15 engineers on AWS budgets $5,000 to $15,000 for readiness assessment and gap analysis.
• Secureframe says a professional readiness assessment will run about $15,000.
• Bright Defense says a readiness assessment usually costs $5,000 to $20,000. The same page gives narrower figures elsewhere (for gap analyses, $4,000 to $10,000), so even one seller’s page isn’t settled.

Read together, outside help in these sources runs from about $4,000 to $25,000, and the small-company example sits at the low end. A few things move a quote:

• Scope. How many of the five categories, and how many systems, are included.
• How much you already have. Written policies and running controls shorten the work. Starting from nothing lengthens it.
• What the price covers. Vanta’s page tells buyers to ask whether the readiness assessment, a penetration test, and fixing the gaps are in the number or billed separately.

The assessment is rarely the largest cost. Thoropass puts the audit itself at $5,000 to $40,000 for a Type 1 and $15,000 to $100,000 or more for a Type 2, and fixing the gaps at $5,000 for a small company with strong practices up to $250,000 or more. Those are one seller’s estimates too. The point is the order of magnitude: the assessment tells you what the rest will take, so it is worth doing at a price that suits your size.

What you can do yourself first

Most of a readiness assessment is asking what is true and writing it down, and you know your company better than a stranger will on day one. This is the order we would work in. It is our judgment, not a standard, and it uses only public frameworks.

1. Decide the scope. Name the product or system a report would cover. Security, the common criteria, is the base; the other four categories (availability, processing integrity, confidentiality, privacy) are optional, and which go in scope is a decision for you, your customers, and a CPA firm. A smaller scope is a shorter assessment.
2. Write the fact sheet. One line per fact: where you host, how people sign in, who has access to production, how laptops are managed, where customer data lives, what you log, how backups work and when one was last restored, how an incident is handled, which vendors touch customer data, and how people join and leave. Day 2 of our five-day plan has the full list. Put the name of the person who told you next to each line.
3. List your policies and what state they are in. For each, a date and one of: approved and in effect, a draft, or missing. A draft is not a policy you have. Our guide to the first five policies says which to write first.
4. Walk the criteria. Take the common criteria, CC1 to CC9, and for each area ask three questions: what do we do, who owns it, and what record shows it happened? Keep the answers in a table with those three columns.
5. Sort each row into one of four states. Running and recorded: you do it and can show the record. Running, not written: you do it, but nothing says so. Written, not running: a policy describes it and nobody does it. Neither. The second needs a document. The third is the dangerous one: a written control you don’t run is worse than a gap, because it is a statement that isn’t true.
6. Rank the gaps. Put first what a customer already asked about, then what protects customer data, then the rest. Give each an owner and a date, or mark it “not planned” and mean it.
7. Start the records. A report on how controls worked over a period needs proof from that period. Access reviews, change approvals, and incident drills are kept each time, with a date and a name. Start now, whether or not you have chosen a CPA firm.

When you finish you have a gap list, a policy list, and a fact sheet. That is most of what a paid assessment hands back, and it is also what a consultant will ask you for on day one.

When it is worth paying for

Do it yourself when the scope is one product, your team already runs most of what it should, and the goal is a first honest list. Pay for help when one of these is true:

• A customer or investor wants an outside view, and your own list won’t be taken as one.
• You did the walk above and can’t say what a row means. A second pair of eyes from someone who has seen audits earns its fee there.
• Nobody on the team has the time. The work is mostly asking people questions, and it stalls without an owner.
• Your scope is large: several products, several data stores, or customers who want more than the Security category.

Whoever you hire, ask these before you sign. They are our judgment.

1. What will I get back: a report, a table, a plan, a call?
2. Which categories and systems are in the price, and what costs extra?
3. Are fixing the gaps, a penetration test, or a software platform in the number?
4. Who does the work, and is it the firm that will audit me? If it is, how does it keep the two jobs apart?
5. Do you promise I will pass? Walk away from a yes. Nobody outside the CPA firm can promise that, and not even the CPA firm can before it has examined you.

If you want the documents written

Blank Slate Creative, LLC does readiness and documentation only. We never audit or attest, and we don’t sell a readiness assessment as a priced package. This guide draws on public standards and our own judgment, not client work. We have no clients yet, and would rather say so.

• A SOC 2 gap analysis, by quote. A written list of where your documents fall short of the criteria. It is documentation, not an examination, and we can’t promise a customer will accept it in place of a report. Scope and price are agreed before work starts. Ask for a quote.
• The five core policies, tailored to your stack. If the walk above shows policies missing, these are the first five, with the SOC 2 criteria they support cited inline, for a flat $85. Order the five policies, $85.
• A person reads your policies. Each custom policy set is read before it is sent to you. We can’t promise that your customer will accept documents in place of a report, or how an examination will go.
• See it first. The home page has two full sample policies, written for a fictional company.

Sources

The prices above are other companies’ published figures, not ours and not checked by us. All pages were read on 2026-10-11.

• Vanta, How much does a SOC 2 audit cost? (the readiness assessment line of its cost table; the page shows no date).
• Thoropass, SOC 2 audit cost: A guide (published June 5, 2025; the $0 to $25,000 range, the 15-engineer example, and the audit and remediation figures).
• Secureframe, How Much Does a SOC 2 Audit Cost in 2025? (the page shows no date).
• Bright Defense, SOC 2 Certification Cost in 2026 (updated October 6, 2026).

Vanta and Secureframe sell compliance software, Thoropass sells audits on its own platform, and Bright Defense sells compliance services. What a readiness assessment is, and our advice on doing one yourself, is our own judgment. It cites no outside source.