SOC 2 for a five-person SaaS: what the audit costs and when a customer really needs it

Somewhere in the second or third call with a bigger customer, someone asks: "Do you have a SOC 2?" There are five of you. You do not. The question that follows in your head is two questions, really: how much would it cost to get one, and will this deal die without it?

This article answers both with numbers. What the two types of report are, what the auditor, the software and the penetration test cost in 2026, how long each step takes, a full year-one budget for a five-person company, what you can send instead while you wait, and the arithmetic that tells you when the report pays for itself.

If you have already been sent the two-hundred-row spreadsheet, start with our piece on what a five-person vendor can honestly answer on a security questionnaire. This one picks up where that one leaves off: the point where somebody wants the audit itself.

What SOC 2 is, in two paragraphs

A SOC 2 report is an attestation by a licensed CPA firm about your controls, measured against the AICPA's Trust Services Criteria (the 2017 criteria, with points of focus revised in 2022). There are five categories: security, availability, processing integrity, confidentiality and privacy. Only security is required. It is not a certificate and there is no pass mark; the auditor writes an opinion, lists any exceptions found, and the report goes to customers under NDA.

The criteria say what must be true, not how. "Logical access is restricted" can be met by a five-person company with Google sign-in and two-step verification just as well as by a bank with a badge system. That is why a small company can get through it at all, and also why the cost depends so much on the auditor and on how much of the evidence you collect by hand.

Type 1 or Type 2

The trap is to treat Type 1 as a cheaper version of the same thing. It is a different statement. A Type 1 says your controls exist; a Type 2 says somebody checked that you followed them. Many buyers will accept a Type 1 for the first contract year if the Type 2 window has already started, and almost none will accept a Type 1 for a renewal.

Our default advice for a company of five: if a signed deal depends on having something by a date less than six months away, do the Type 1 and start the Type 2 window the day after it. If nobody is waiting, skip the Type 1, run a three-month Type 2 window and save the fee.

The software: Vanta, Drata and Secureframe in 2026

None of the three publishes a price. The most useful public numbers come from Vendr, a software buying service that reports what its customers actually paid. Its marketplace pages, last updated in February 2026, show:

A five-person company sits at the bottom of each range, because the price is built mostly from headcount and number of frameworks. The lowest figures in the table, $7,500 to $9,500, are what a very small company buying one framework can realistically get to after a competitive quote. Get quotes from at least two of the three at the same time and tell each that you are doing so; that is where the 15 to 30 per cent comes from.

What the platform does: connects to your cloud account, code host, identity provider and staff laptops, checks settings continuously, gives you policy templates and a list of tasks, and hands the evidence to the auditor in the format they expect. What it does not do: the audit. The auditor is a separate contract and a separate bill, even when the platform introduces you to one. Watch for add-ons sold in the same meeting: Vendr lists vendor risk management at $5,000 to $15,000 a year and questionnaire automation or a trust page at $3,000 to $8,000 each. A five-person company needs none of them for a first report.

Can you skip the platform? Yes. The criteria do not require one, and some boutique auditors will work from a shared folder of screenshots and exports. The saving is the platform fee; the cost is founder time, mostly in the evidence collection for a Type 2, where you must show that every quarterly access review, every new joiner's training and every change approval happened on time. With fewer than ten systems and five people it is doable. Expect roughly twice the internal hours.

The other bills: auditor, penetration test, small tools

Auditor. Drata's March 2026 figures for small and mid-sized companies: $7,500 to $15,000 for a Type 1 and $12,000 to $20,000 for a Type 2. Vendr's Drata page gives a wider $8,000 to $25,000 for a Type 2. Smaller CPA firms that specialise in startups sit at the low end; the large firms are not interested in a company your size and price accordingly. The report carries the firm's name, and a few large buyers do look at it, but for a first report any licensed firm with a track record of SaaS reports is fine.

Penetration test. The criteria list penetration testing as one kind of evaluation to consider rather than a hard requirement, but in practice your auditor and every buyer reading the report will expect one in the last twelve months. Published 2026 prices for a small SaaS web application run from about $5,000 for a tightly scoped test of one app to $15,000 to $35,000 for a multi-role app with an API. A quote near $2,000 is usually an automated scan with a report cover; buyers can tell.

Small tools. Device management for laptops (screen lock, disk encryption, updates), background checks on staff where the law allows, and a security awareness training course. For five people these are a few hundred to low thousands of dollars a year, and the platforms often bundle the training.

Your time. The bill nobody quotes. Writing a dozen policies that describe what you actually do, fixing the gaps, a risk assessment, an access review every quarter, vendor reviews, and answering the auditor's sample requests. For a five-person company with a platform, budget about 150 hours of one founder's time across the first year. That is our estimate, not a published figure; it is the line that most often surprises people.

A year-one budget for a five-person SaaS

Assumptions: one product on a major cloud provider, Google Workspace or Microsoft 365 for identity, five staff laptops, security category only, a platform bought at the small-company end of Vendr's ranges, a startup-focused auditor, one scoped penetration test. Founder time valued at $100 an hour to make it visible; leave it out if you prefer cash only.

Two things stand out. First, Path B is $10,000 cheaper than Path A and gets a Type 2 out three months sooner; the Type 1 only earns its fee when a buyer needs a report before month eight. Second, the recurring cost is most of the first year's cost. SOC 2 is not a project you finish; it is roughly $37,000 a year in cash for as long as you sell to buyers who want it, and that is the figure to weigh against deals.

Path C looks cheapest and is usually the worst value: a Type 1 that is never followed by a Type 2 ages badly, and the platform contract is annual whether you continue or not.

The timeline, week by week

The four-to-eight-week gap after the window closes is the one to pin down. Ask the auditor to put a report delivery date in the engagement letter. A buyer will plan around the date you give, and "the auditor is still writing it" lands badly in week nine.

What you can send before the report exists

The common mistake is asking an auditor for a "bridge letter" before the first report. That is not what a bridge letter is. A bridge letter (or gap letter) is written and signed by your own management, not by the auditor. It covers the gap between the end of your last report's period and today, names the CPA firm that did the last audit, and states any changes to controls since. Vanta describes the industry standard as no more than three months of gap, and the AICPA has no official template. It is a tool for year two, when your Type 2 period ended in June and the next report is not out until October.

Before the first report, these are what actually move a buyer:

The last row is the one that closes deals. A buyer's risk team is rarely allowed to waive the requirement; they are often allowed to accept a dated commitment with a way out. Offer it before they ask. We cover how that clause fits with the liability and security sections in the first enterprise contract: six clauses to read twice.

Which deals actually stall without it

There is no good independent survey of how many small-vendor deals die for want of a report. Compliance vendors publish figures, but they sell the cure. What can be said with confidence is who asks and why, and that predicts whether your deal will stall.

Buyers who are SOC 2 audited themselves. Their own auditor checks how they vet suppliers who touch customer data (the vendor management criterion, CC9.2). Your report is evidence in their audit. These buyers ask every time and have the least room to bend, though the dated commitment above often works.

Banks, insurers, payment companies and anyone regulated on outsourcing. Their regulators expect documented third-party risk management. Expect the full questionnaire and the report request; expect a long review even with the report.

Companies above roughly 500 staff with a procurement team. The request comes from a process, not a person. Your champion likes the product but cannot skip the step.

Products that hold the buyer's customer data, or connect into their systems. An analytics tool reading their production database or an integration with admin rights to their Microsoft 365 tenant is high tier. A scheduling widget holding staff names and work emails is low tier, and a short questionnaire usually suffices.

Deals that rarely stall: buyers under about 200 staff, self-serve purchases on a card, pilots under the buyer's procurement threshold, and tools that hold no customer data at all. If all your current pipeline is in this group, a report is a cost with nothing to show for it yet.

Note what is not on the list: healthcare. A US healthcare buyer needs a HIPAA business associate agreement, which is a different obligation. Some will ask for SOC 2 as well, but the report does not replace the agreement.

When does it pay for itself?

Take the Path B figures: $36,500 cash in year one and $37,340 a year after. Count only revenue that would not close without the report, and only its gross profit. At an 80% gross margin:

So the rule from the questionnaire article still holds, now with figures: one buyer asking is not a reason. Start when the deals that need the report add up to about $46,000 a year, or one buyer worth that much makes it a written condition. Below that, sell with the self-assessment, the pen test letter and the dated commitment, and keep the list of every buyer who asked. When that list adds up to the number, buy.

If you go ahead: five ways to keep the bill small

Security only. Add availability or confidentiality only when a buyer names them. Each extra category is more controls, more evidence and a bigger auditor fee.

Shrink the scope before the auditor sees it. The systems in scope are the production app and what touches customer data. If an old staging server or a forgotten database has customer data on it, delete it rather than bring it under controls.

Buy the platform and the auditor at the same time, in the same quarter. Platforms discount more at quarter and year end (Vendr cites 5 to 15 per cent extra), and some offer an auditor bundle. Compare the bundle with a direct quote from the auditor; it is not always cheaper.

Book the pen test with retest included. A test without a retest leaves you with a report full of findings and no proof they were fixed, which is the thing the buyer will read.

Write policies you already follow. The auditor tests what the policy says. A policy that promises daily log review becomes an exception in the report the first week you skip it. Promise weekly and do it.

A five-person company can get a clean Type 2. Plenty have. The ones that do it well treat the report as the cost of selling to one kind of buyer, buy it when the pipeline says so, and in the meantime sell with honest answers and a date.

Sources

Vendr: Vanta pricing, Drata pricing and Secureframe pricing (median, low and high contract values, purchase counts, small-company ranges, discounts, add-ons and audit fee ranges; pages last updated February 2026); Drata: how much does a SOC 2 audit cost (25 March 2026) (Type 1 and Type 2 auditor fees, process lengths, observation periods); AICPA: 2017 Trust Services Criteria with revised points of focus (2022) (the five categories, CC9.2, penetration testing as a point of focus); AICPA: SOC 2 reporting guide (October 2022); Vanta: what is a SOC 2 bridge letter (who writes it, contents, the three-month standard); Bastion: how long does SOC 2 take and soc2auditors.org: how long does a SOC 2 audit take (no AICPA minimum window, three months as the usual floor); Astra: penetration testing cost in 2026 and Blaze Information Security: penetration testing cost 2026 (web and SaaS test price ranges and durations); Cloud Security Alliance STAR (free Level 1 self-assessment); Minimum Viable Secure Product (the 25-control baseline). Year-one and year-two budgets, the founder-hour estimates and the break-even arithmetic are our own, from the figures above.