SOC 2 Cost Calculator Methodology

Our SOC 2 cost estimate is built from four line items, each with its own baseline range and a stack of multipliers. Bands are guidance from our curated baseline, not statistical confidence intervals.

Line items

Auditor fees (auditFee)

Curated baseline range: $18,000 (P25) to $55,000 (P75), with a typical (P50) of $30,000. Multipliers stack on top of this baseline by audit type, employee band, industry, prior audit history, and control complexity. Type 1 lands roughly 45% below Type 2 in our model; an engagement covering both Type 1 and Type 2 runs about 45% above Type 2 alone.

Compliance automation platform (automationTool)

Annualized platform cost baseline: $8,000 to $32,000, typical $18,000. Selecting no platform zeros this line item; otherwise the platform factor and your employee band scale the number. Smaller teams pay less; larger teams pay more, by employee-band multiplier.

Readiness or prep consultancy (prepConsultancy)

Curated baseline $8,000 to $45,000, typical $22,000. First-time engagements typically run 20% higher than repeat engagements; high control complexity adds another 25% on top.

Internal staff time (staffTime)

Hours baseline: 120 (P25) to 480 (P75), typical 240 hours, costed at a blended hourly rate of $165. Using a compliance automation platform applies a discount factor of 0.65; adding a prep consultancy applies a further factor of 0.8. Industry, prior history, and control complexity each contribute their own multipliers.

Confidence band (bandFlex)

Within each line item we pick the P25, P50, and P75 of the curated baseline. We then apply two scope-flex factors at the total level. The low total reduces by 15% to reflect a minimum-scope assumption (no prep consultancy, smaller observation window); the high total uplifts by 10% to reflect a full-scope assumption (consultancy, extended timeline). The typical total is the unflexed P50 sum.

We label these bands as guidance, not statistical confidence intervals, because the curated baseline ships from public benchmarks, industry surveys, firm directory pricing, and direct conversations rather than a representative sample.

Firm matching

When we recommend a firm based on your inputs, we score every firm in our directory against six axes and return the highest-scoring match plus up to two alternates. The axes and their weights are:

Firms that match nothing on any axis are excluded from recommendations; we surface a directional starting point message rather than guess.

Vendor scoring methodology

The paid-tier vendor stack comparison filters automation platforms and prep consultancies through hard-gate eligibility rules first, then ranks them with a weighted-sum score over four traits. The weight vector and gate flags below are rendered directly from the same constants the scoring engine reads, so engine and copy never drift.

Hard-gate rules

Weight vector

TraitWeight
Automation depth40%
Integration breadth30%
Size band fit20%
Price transparency10%

Vendor data freshness

Each vendor entry carries at least one source URL with a last-reviewed date. Entries are reviewed quarterly per the vendor refresh runbook. The most recently reviewed entry was reviewed on 2026-05-07.

Anonymized benchmarks methodology

Benchmark cohorts partition the curated dataset across four axes: industry, company size band, audit type, and TSC criteria count. The minimum sample size for a credible cohort is N = 10.

When the exact cohort has fewer than 10 data points, the cohort widens in this order: drop criteria count first, then drop audit type, then drop industry (size band only). The cohort prose surfaced in the paid view names the widening explicitly, so a buyer always knows whether the range covers their exact scope or a wider rollup.

Version and changelog

Current cost-model version: 2026.05.0. Persisted result pages stamp the version they were computed under, so historical estimates always render the numbers their owners saw, even if the model is updated later.