SOC 2, from first check to final report
Viglyn runs continuous checks against your stack, collects evidence that proves its own integrity, and hosts the Type 1 or Type 2 examination itself.
What is SOC 2?
SOC 2 is an attestation report, not a certificate. An independent CPA firm examines the controls a service organization operates for security, and optionally for availability, processing integrity, confidentiality and privacy (the five Trust Services Criteria defined by the AICPA), and issues an opinion. A Type 1 report describes whether the controls were suitably designed at a point in time. A Type 2 report tests whether they operated effectively over a review period, usually three to twelve months, which is why enterprise buyers ask for Type 2. There is no pass or fail: the report lists any exceptions the auditor found, and buyers read them. Getting SOC 2 ready means putting real controls in place (access management, change management, monitoring, vendor oversight, incident response), collecting evidence that they operate, and keeping that evidence current through the review window and beyond.
SOC 2 is an attestation developed by the AICPA that reports on how a service organization protects customer data against the Trust Services Criteria. A Type 1 report assesses how your controls are designed at a point in time; a Type 2 report assesses how they operate over a period.
B2B SaaS and technology companies that handle customer data. It's the report enterprise buyers in North America ask for most during vendor due diligence.
How Viglyn runs SOC 2
- Automated checks run across your cloud, identity, device, code, and HR systems on demand, daily, or hourly
- Evidence is the actual system response, hashed for integrity, so nothing rests on screenshots
- The examination runs inside Viglyn: structured evidence requests, auditor access you control, threaded comments, exportable workpapers with integrity hashes
- The same evidence maps to ISO 27001 and any other framework you add, with no cap on frameworks
The SOC 2 questions that decide it
How long does SOC 2 take?
A Type 1 report is achievable in weeks when the controls already exist, and Viglyn's continuous checks and included implementation close most gaps in that time. A Type 2 report cannot be compressed the same way: it reports on an observation window, typically three to twelve months. We tell you the real timeline for your starting point before you commit.
How much does SOC 2 cost?
With Viglyn, the platform, implementation by our practitioners and audit support cost from $2,699 a year for a team of up to 25. The independent auditor's fee is the only separate line: you choose the firm and pay them directly, and we add nothing to it.
Do we need a consultant for SOC 2?
Not with Viglyn. Most compliance platforms hand you a list of gaps and leave the closing to a consultant who often costs more than the software did. Our practitioners write the policies, build the controls and prepare the evidence with your team, inside the same workspace the auditor works in.
SOC 2 against the standards it is weighed with
More SOC 2 questions
Should we do Type 1 or Type 2?
Who performs the audit?
Does the evidence stay current between audits?
See SOC 2 run on your stack
A 30-minute walkthrough with your systems and your framework. No commitment.