FAQ
SOC 2 FAQ
TL;DR. First SOC 2 success looks like scoped controls, named owners, weekly evidence, and a clear Type 1→Type 2 story for procurement—not a surprise PDF at quarter-end.
Questions founders ask
Decide
Type 1 vs Type 2—which first?
Most seed teams: Type 1, then Type 2 window. Exceptions exist for hard Type 2 requirements.
Do we need SOC 2 to sell to enterprises?
Often yes for security review; sometimes questionnaires and Type 1 suffice temporarily. Ask your buyer.
How much does SOC 2 cost in 2026?
Plan for auditor fees plus tooling/consulting and heavy internal time. See our cost breakdown spoke.
Operate
What is an observation window?
The period a Type 2 examination covers to test whether controls operated effectively—not just whether they were designed.
Do we need a GRC tool in the first 90 days?
Not strictly. You need owners, evidence, and an auditor. Tools help when integrations save weekly hours.
Engage
When should we engage an auditor?
Once scope and owners exist and core identity/change controls are running—often during a 90-day readiness push.
Is an engagement letter the same as a report?
No. It proves you hired an examiner for defined scope.
Buyers
Can we share CAIQ-Lite while in progress?
Yes—keep answers versioned and honest about status.
Is ProofWindow a GRC product?
No. Educational content only—no live affiliate claims or product checkout. Google AdSense may load on hubs (ca-pub configured; money-status ads=live_pending_site_approval — pending Sites Ready, not Ready).
Sources
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.
- primary 2017 Trust Services Criteria (With Revised Points of Focus – 2022) — AICPA & CIMA — Authoritative TSC document (Security/Availability/Processing Integrity/Confidentiality/Privacy).