SOC 2 Trust Services Criteria: how each one changes your audit cost.
Per-criterion cost section
Security (mandatory). The baseline. Common Criteria controls cover access management, change management, risk assessment, system operations, and communication. Every SOC 2 report includes Security. There is no SOC 2 without it.
Confidentiality. Adds controls around classification of confidential information, retention and disposal, and protection during transmission. Audit fee impact: roughly 18 percent. Readiness time impact: 10 to 12 percent. Customer-driven where contractual confidentiality clauses are common.
Availability. Adds controls around system monitoring, capacity planning, incident response for availability events, backup and restoration. Audit fee impact: roughly 18 percent. Readiness time impact: 10 to 12 percent. Customer-driven where uptime SLAs are part of the contract.
Processing Integrity. Adds controls around data input completeness and accuracy, processing accuracy, and quality assurance procedures. Audit fee impact: roughly 18 percent. Readiness time impact: 10 percent. Mostly relevant for transaction-processing platforms (payments, billing, data pipelines).
Privacy. Adds controls around notice, choice and consent, collection, retention, disclosure, access, quality, and monitoring of personal information. Audit fee impact: roughly 18 percent. Readiness time impact: 15 to 20 percent (heavier than the other three). Adding the Privacy criterion to a SOC 2 scope formalises controls that are already required for any processor under GDPR. For teams that are also building a privacy budget independently, the GDPR-specific cost drivers are detailed at gdprcompliancecost.com.
Minimum-viable scope
For a first-time SOC 2 with no specific customer driver, Security only is sufficient. It produces a complete SOC 2 attestation, costs the least, and leaves room to add criteria in year 2 if customers ask. For B2B SaaS where customer contracts already include confidentiality language, add Confidentiality from the start to avoid a year-2 scope expansion. For platforms with uptime SLAs, add Availability.
Resist the temptation to add criteria you do not yet need. Each one adds cost, readiness time, and ongoing maintenance. Scope can always grow at renewal; it cannot easily shrink once customers expect it.
Cost-modelled scope examples
| Scope | Audit fee | Year-1 all-in |
|---|---|---|
| Security only | £22,000 – £32,000 | £32,000 – £58,000 |
| Security + Confidentiality | £26,000 – £38,000 | £37,000 – £67,000 |
| Security + Confidentiality + Availability | £30,000 – £43,000 | £42,000 – £75,000 |
| Security + Confidentiality + Privacy | £33,000 – £47,000 | £48,000 – £85,000 |
| All five criteria | £37,000 – £52,000 | £55,000 – £100,000 |
Try the scope toggle
Tick Security plus any subset of the optional four to see the audit-fee delta update live. The numbers shown are the audit-fee component only; readiness and tooling lines move at similar but smaller rates per added criterion.
Each additional TSC adds roughly 18 percent to the audit-fee line. Readiness time is also affected, by 8 to 12 percent per criterion. Numbers above show the audit fee delta only.
Cross-reference
For the readiness component that scales with each criterion, see the readiness cost page. For the audit-fee tier that scales with the criteria total, see the audit firm fees page. For the scale-up bracket where adding criteria becomes a budget conversation in itself, see the scale-up cost page.