A SOC 2 report is an attestation, not a certification. A licensed CPA firm examines your controls against the AICPA's criteria and issues the report. The total cost has several parts, and only one of them is Goldline's fee.
What makes up the cost?
- Readiness support. Getting your scope, policies, risks and controls ready for the examination. Goldline's SOC 2 Readiness Sprint covers readiness through to a type 1 report on the AICPA security criteria.
- The CPA firm's fee. The CPA firm quotes and charges its own fee, which you pay to the firm. Goldline does not set it and does not publish it.
- Your team's time. Your own team's time is the cost most organisations underestimate.
- Remediation. Closing the gaps found during readiness. The cost depends on what is found.
- Tooling. Goldline works in your compliance platform if you have one, or in Goldline's UK-hosted GRC workspace at no extra subscription. Any licence needed for tools you choose is quoted separately and set out in your engagement letter.
Fees
Goldline's SOC 2 Readiness Sprint is £7,000, plus VAT, for a single legal entity with up to 50 people in scope, one site or cloud hosted. A larger or multi-entity scope is scoped on the free diagnostic. Support through a type 2 observation period is provided through Evidence Essentials, from £495 a month plus £8 per user, plus VAT, on a 12-month term. The CPA firm's fee is separate and paid to the firm. Goldline never carries out the examination, never issues a SOC 2 report and does not promise what the CPA firm's opinion will say. See every price
Related links: /services/pre-certification-readiness-audit, how to choose an ISO 27001 consultant, ISO 42001 guide. SOC 2 service page.