When an enterprise customer asks an Australian software company for “your SOC 2”, they almost always mean the SOC 2 Type 2 report. It is the one that carries weight, because it covers how your controls behaved over a period rather than how they looked on a single day.
This page explains what a Type 2 report is, how it differs from Type 1, how long the observation period should be, and what the whole thing costs in Australia.
A licensed CPA firm examines your controls against the AICPA Trust Services Criteria and issues a report. The report describes your system, lists the controls you said were operating, sets out the tests the auditor performed, and gives an opinion on whether those controls operated effectively across the period examined.
It is an attestation, not a certification. There is no certificate and no badge you are entitled to put in your website footer. What you hand a customer is the report, usually under NDA, and what they do is read the testing results and the opinion at the front.
| Type 1 | Type 2 | |
|---|---|---|
| What is examined | Whether the controls are suitably designed | Whether the controls were suitably designed and operated effectively |
| Time covered | A single point in time | A period, usually three to twelve months |
| Evidence required | That the control exists and is documented | Samples drawn from across the whole period, showing the control actually ran |
| How long to get one | Once you are audit ready | Audit ready, then the full observation period, then the examination |
| What customers accept | Sometimes, as an interim step | What enterprise buyers normally insist on |
A Type 1 is worth doing when a deal is live and you need something credible in front of a customer quickly. It buys time. It is not a destination, and a customer who has read a few of these will ask when the Type 2 is coming.
The period is your choice, within reason, and it is the single biggest decision in the process because it sets how long before you have a report in hand.
| Period | When it fits | Trade-off |
|---|---|---|
| Three months | A first Type 2, where a customer is waiting and you need a report as soon as the controls can honestly be said to have run | A short window gives the auditor fewer samples, and some customers notice |
| Six months | The usual middle ground for a first report when there is no hard deadline | Six months of evidence collection before anything is issued |
| Twelve months | The steady state once you are on an annual cycle | Too long to wait for a first report if a deal depends on it |
Most Australian software companies we work with run three months for the first report and then move to twelve month periods so the reports join up year on year.
This is where Type 2 differs from every other compliance exercise. The auditor does not just want to see the policy. They want evidence that the control ran, repeatedly, across the whole window, and they will sample it.
| Control area | What the auditor samples |
|---|---|
| Access management | Joiners and leavers across the period, and whether access reviews actually happened on schedule |
| Change management | A selection of code or infrastructure changes, with approval and testing evidence for each |
| Vulnerability management | Scan results, penetration test reports and the remediation record behind them |
| Incident response | Any incidents that occurred, and whether they were handled the way the plan says |
| Monitoring | That logging and alerting were in place and that alerts were actioned |
| Vendor management | Reviews of your own critical suppliers across the period |
The practical consequence is that evidence has to be collected as you go. A business that waits until the end of the period and then tries to reconstruct nine months of access reviews will not get a clean opinion.
A Type 2 report covers a period that has already ended. If your report covers January to June and a customer asks for it in October, there is a gap of four months the report says nothing about.
A bridge letter, sometimes called a gap letter, is a short statement from your management confirming that nothing material changed between the end of the report period and the date of the letter. It is written by you, not by the auditor, and most customers accept it for a gap of up to about three months. Beyond that they will usually want the next report.
| Criterion | Include it when |
|---|---|
| Security | Always. It is the common criteria and every SOC 2 report includes it |
| Availability | You have made uptime commitments in customer contracts or an SLA |
| Confidentiality | You hold customer data that is commercially sensitive rather than personal |
| Processing integrity | You process transactions or calculations where correctness is the product |
| Privacy | You handle personal information in a way that goes beyond ordinary account data |
Adding criteria adds controls, evidence and cost. Many Australian SaaS companies start with Security alone, add Availability because a customer contract required it, and leave the rest unless there is a reason.
Our compliance package covers SOC 2 at $2,750 per month excluding GST over twelve months for up to 50 employees, on contracts signed by 31 December 2026, down from $3,750. That covers the policies, the risk assessment, the internal audit, the training, the external penetration testing and the compliance platform.
The CPA firm that performs the examination is independent and bills you directly, typically $5,000 to $15,000 depending on your size, your scope and the number of criteria included. We can introduce you to firms we work with regularly.
Expect three to nine months to be audit ready, then the observation period you have chosen, then the examination itself. The wider programme is covered on our SOC 2 compliance page, and the framework decision is covered on SOC 2 vs ISO 27001.
How we deliver it. SOC 2 is delivered through our CERTIFY for SOC 2 package at a fixed monthly price, covering the policies, the risk assessment, the internal audit, the training, the external penetration testing and the compliance platform. If you need ISO 27001 as well, CERTIFY for ISO 27001 runs on the same model, and the full compliance price list sets out what each package includes.
If you would rather run the evidence collection in-house with software than hand the programme to a consultancy, CertAssist is a compliance platform built for small teams working towards their first SOC 2 report.
Type 1 examines whether your controls are designed properly at a single point in time. Type 2 examines whether those controls actually operated effectively across a period, usually three to twelve months, with the auditor sampling evidence from across that window. Type 2 is what enterprise customers normally want.
Not strictly. SOC 2 is an attestation issued by a licensed CPA firm, not a certification, so there is no certificate. People search for and talk about SOC 2 Type 2 certification because that is the natural way to describe it, but what you receive is a report.
Three to nine months to become audit ready, then your observation period on top, then a few weeks for the examination and the report to be issued. A first Type 2 with a three month window realistically lands six to twelve months from a standing start.
Our fee is $2,750 per month excluding GST over twelve months for up to 50 employees on contracts signed by 31 December 2026. The CPA firm examination is separate and independent, typically $5,000 to $15,000.
It is not valid or invalid in the way a certificate is. It describes a period that has ended. Customers generally treat a report as current for about twelve months from the end of the period, with a bridge letter covering any recent gap.
SOC 2 does not name penetration testing as a mandatory control, but auditors routinely expect to see regular technical testing as evidence of your vulnerability management, and most customers reading your report expect it too. External penetration testing is included in our compliance packages.
Tell us who is asking for the report and when they need it, and we will come back with a fixed monthly price, a recommended observation period and a realistic date for having a Type 2 in your hands.
Next step: Send us your details and we will put a number in front of you, or see the full compliance price list.