SOC 2 cost in the UK: what 25–250 person firms pay

Your US prospect's security team wants a SOC 2 report before the contract moves, and your board wants a number before it signs anything off. Most SOC 2 cost guides quote US dollars for a US startup. This guide is for founders, finance leads and security leads at UK B2B tech firms with 25 to 250 staff.

It breaks SOC 2 cost into the lines that make it up, shows what moves each one, and gives you a budget you can defend line by line. For what SOC 2 covers and why buyers ask for it, start with our SOC 2 overview.

How much does SOC 2 cost for a UK firm?

SOC 2 cost has no published price list, because no two examinations are the same size. A first report is built from four lines: readiness and remediation, the CPA firm's fee, tooling and your own team's time. Three factors move the total most: scope, how ready you are before fieldwork, and the report type with its observation window.

The AICPA says as much itself. In a Journal of Accountancy podcast on quick-turn SOC engagements, its vice president for assurance and advisory innovation explains that a SOC 2 engagement can cover one to all five trust services categories, and can be complex or relatively simple depending on the business.

That is why a single headline figure is misleading. A 40-person SaaS firm reporting on Security alone and a 200-person platform reporting on four categories across two hosting regions are buying different examinations.

Searchers often call this "SOC 2 certification cost". The report is an attestation by a licensed CPA firm, not a certificate, but the budget questions are the same.

What are the four SOC 2 cost lines?

The four SOC 2 cost lines are readiness and remediation, the CPA firm's examination fee, tooling, and internal time. Only the fee arrives as a quote. The other three depend on how much security practice you already run, how much help you buy in, and whether evidence comes from your systems or from people.

Budget each line separately. They behave differently between a first Type 1 report, a first Type 2 report and the years after.

Readiness is where budgets diverge most. A firm that already runs single sign-on, managed devices, code review and tested backups mostly needs to evidence its controls. A firm without them has to build the controls first, and that is an engineering cost before it is a compliance cost.

Tooling is worth its subscription only when it removes recurring work. A platform that stores policies while someone still screenshots evidence each month adds a cost without removing the hours.

Internal time is the line nobody invoices, so it is the line nobody budgets.

How does a CPA firm build a SOC 2 audit fee?

A CPA firm builds a SOC 2 audit fee from the size of the examination: the trust services categories in scope, the systems and locations that deliver the service, the subservice organisations involved, and the length of the observation period for Type 2. More scope means more controls to test and more evidence to sample.

The fee drivers to check before you ask for quotes:

• Trust services categories. Each category you add brings its own criteria and controls to test. Add one only when a customer contract needs it.
• Systems in scope. Every application, database and infrastructure layer that delivers the service has to be described and tested.
• Locations and entities. More offices, hosting regions or legal entities inside the boundary mean more to understand and sample.
• Subservice organisations. Your cloud host and other critical suppliers either sit outside the report or are tested within it, and the choice changes the work.
• Report type and period. A Journal of Accountancy article on SOC 2 reporting advises the auditor to consider whether the report period is long enough to form an opinion on whether the controls operated effectively. Choosing between report types has its own guide: SOC 2 Type 1 vs Type 2.

Who signs the report also matters. The AICPA's podcast explains that these engagements must be performed by licensed CPAs under US state law, so whoever you buy from, the report must come from a licensed CPA practice. Ask every UK firm that quotes which licensed practice will sign.

Most of these drivers are settled before you request a single quote, by how tightly you scope and how ready you are when fieldwork starts.

Scope is a pricing decision disguised as a technical one.

How do you cost internal time for a SOC 2 report?

Cost internal time for a SOC 2 report by naming the people involved, estimating their hours for each activity, and multiplying by what those hours cost you. Use your own salary data where you can. As a reference point, the ONS puts median hourly earnings for UK full-time employees at £19.67 in April 2025.

The ONS Annual Survey of Hours and Earnings gives that figure excluding overtime, and its 2025 estimates are provisional. It is a national median across all occupations, so treat it as a floor for pricing engineers and security leads, not a substitute for your payroll.

At that median, every 100 hours of internal time is about £1,967 in pay before employer costs. The calculation is simple; the hours are what you have to estimate honestly.

List the activities, then put a named owner and an hour estimate against each:

1. Scoping the system, the categories and the subservice organisations.
2. Writing and approving policies that match how the business actually works.
3. Fixing gaps the readiness assessment finds, usually engineering and IT time.
4. Running controls such as access reviews, change approvals and vendor reviews on their stated cadence.
5. Preparing the system description that management asserts to.
6. Supporting fieldwork: walkthroughs, evidence requests and follow-up questions.
7. Responding to exceptions and reviewing the draft report.

For a Type 2 report, activities 4 and 6 repeat across the observation window. Price them per month, not once.

What does SOC 2 cost in year two and beyond?

SOC 2 cost in year two is mostly recurring: a fresh examination for the next period, tooling renewals and the internal time to keep controls running. One-off readiness and remediation largely fall away. In the same podcast, the AICPA stresses that SOC 2 engagements should be done annually, because things change over time.

The recurring lines to budget each year:

• The next examination. We recommend planning year two as a Type 2 even if the first report was a Type 1, so each period follows the last.
• Tooling renewals, set against the evidence hours the tool now removes.
• Control operation, the monthly and quarterly work that keeps the evidence trail complete.
• Gap cover between periods. If a report period ends well before a customer asks, you may need to explain the gap, often with a bridge letter until the next report is issued.
• Scope changes. New products, regions or categories make the next examination bigger.

Plan the report periods so they run back to back. A gap in coverage costs nothing on an invoice, but it costs time in every security review that spots it.

What does a worked SOC 2 budget look like for a 60-person SaaS firm?

A worked SOC 2 budget for a 60-person UK SaaS firm has the four cost lines in three columns: a first Type 1 year, a first Type 2 year and a steady-state year two. The shape matters more than any single figure, because it shows the board which lines are one-off and which recur.

Picture a firm hosted on one public cloud, with single sign-on, managed laptops and a code review process, reporting on Security and Availability.

To turn the shape into numbers, take three like-for-like quotes for the CPA firm's fee, a fixed-scope quote for readiness, a tooling subscription quote and your own hour estimates priced from payroll.

The firm in this example already runs most of the controls a Security and Availability scope tests. Its readiness spend goes on evidence, policy and the system description rather than on new engineering. A firm without those basics should expect the readiness line to dominate the first year.

What does an existing ISO 27001 ISMS take off the SOC 2 bill?

An existing ISO 27001 ISMS reduces SOC 2 cost by supplying controls and evidence you already run: risk assessment, access reviews, supplier management, incident response and change control. The AICPA publishes a mapping from ISO 27001 to the trust services criteria. The examination fee stays, but readiness and internal time shrink.

The AICPA mapping of the trust services criteria to ISO 27001 compares the requirements of the two frameworks category by category. Use it to find where your ISMS already answers a criterion and where it does not.

What carries over:

• Governance: a risk assessment, policies and management review that already have owners.
• Operating evidence: records your ISO 27001 controls produce, such as access reviews and supplier assessments.
• Audit habits: a team used to sampling, evidence requests and corrective action.

What does not carry over is the report itself. A SOC 2 examination tests controls against the trust services criteria over its own period, and the system description is a new document.

If you are budgeting both, our ISO 27001 certification cost guide uses the same four cost lines, so the two budgets sit side by side.

What should a SOC 2 quote include?

A SOC 2 quote should state the report type, the trust services categories, the systems and locations in scope, the period, the subservice organisations and how they are treated, the fieldwork plan and every charge on top of the fee. Without that detail you cannot tell whether a quote is cheaper or simply smaller.

Ask every firm to itemise the same things:

1. Scope: report type, categories, systems, locations and subservice organisations.
2. Period and timetable: the observation window, fieldwork dates and report delivery date.
3. The signing firm: the licensed CPA practice that issues the report.
4. Method: how the firm samples and tests, and how it tailors procedures to your system.
5. Extras: readiness work, bridge letters, re-testing, travel and any platform charges.
6. Independence: what else the firm, or anyone referring you to it, is selling you.

The Journal of Accountancy's article Promises of 'fast and easy' threaten SOC credibility recommends vetting the firm's size, capacity, client references and peer review results, and asking about scope, sampling and independence before you engage.

How can you reduce SOC 2 cost without weakening the report?

You reduce SOC 2 cost by shrinking the work the auditor has to do, not the assurance the report gives. Draw a scope that matches what customers buy, arrive at fieldwork ready, let your systems produce the evidence, and compare quotes on the same scope. Buying the cheapest report usually costs more when a customer rejects it.

The savings that survive a customer's review:

1. Scope to the contract. Add trust services categories only when a customer requires them.
2. Fix gaps before the window opens. Exceptions found in a Type 2 period stay in the report.
3. Let systems produce evidence. Access logs, change records and backup results already exist; connect them instead of rebuilding them in spreadsheets.
4. Reuse what you have. An ISO 27001 ISMS supplies much of the governance and evidence.
5. Ask whether SOC 2 is the right report. Some buyers accept other assurance; an ISAE 3000 report is priced and scoped differently, as our SOC 2 vs ISAE 3000 guide explains.

Cutting the examination itself is the saving to avoid. The same Journal of Accountancy article warns that a cheap SOC 2 report may satisfy a contract but come with obvious deficiencies, and that a savvy partner will spot a cookie-cutter report.

A SOC 2 report priced like a commodity gets read like one.

The AICPA is acting on the same risk. Its guidance to peer reviewers on SOC 2 risks directs them to check whether SOC 2 engagement timelines are reasonable and whether engagements are tailored to each client's risks.

Frequently asked questions