A SOC 2 report is written by a licensed CPA firm, not by you and not by us. What your engineering team owes that firm is evidence that four things work and keep working: who can get in, how a change reaches production, what gets logged and watched, and how infrastructure is defined and changed. We build and run those controls. We do not audit or certify them. A vendor can help you get ready, and only a CPA firm can issue the report.
For scale on what we have actually done: on a portfolio-analytics SaaS platform, a SOC 2-oriented vulnerability gate runs on every merge request, with suppressions that expire. Secrets live in a managed secrets store. That is a control, not a report. We say “SOC 2-oriented”, not “certified”, and I’ll keep to that wording.
What is a SOC 2, and who issues it?
SOC stands for System and Organization Controls. The AICPA describes the SOC suite as services that CPAs may provide on controls at a service organization. A SOC 2 evaluates those controls against the AICPA’s Trust Services Criteria, which cover security, availability, processing integrity, confidentiality and privacy. A report can cover one category or several.
There are two kinds of report. In short, a Type I looks at whether your controls are designed properly on a single date. A Type II looks at whether they operated over a period. A Type II needs your evidence to exist for the whole period, so the controls have to start running before you pick the auditor, and that is the engineering team’s part. What we build for that part is on our SOC 2 engineering page.
What does an audit ask about access?
Who can reach production, and when that stopped being true. In practice:
- Single sign-on and multi-factor authentication on every system that touches production or customer data.
- Least privilege: people have the access their role needs and no more.
- A review of who has access, on a schedule you can show.
- Access removed when someone leaves, with a date.
How we work: engineers use your own accounts and identities, with SSO and MFA and least privilege, revoked when the engagement ends. We run a background check on every engineer before assignment and complete your security questionnaire or vendor assessment on request.
A test you can run today: pick one person who left in the last 90 days and ask whether you can show when each of their accesses ended. If the answer takes an afternoon, an auditor’s sample will take longer.
What does an audit ask about change management?
That every change to production is reviewed, tested and traceable, and that nobody ships around the process. The auditor samples changes and asks for the trail of each.
Ours looks like this. A pull request with a named approver. A CI gate that runs tests, a secrets scan and a vulnerability check. A release cut by tag and deployed by image digest, so what runs is exactly what was tested. In the promotion pipeline of a portfolio-analytics SaaS client, built on Kargo and Argo CD, production waits for a 1-hour soak and verification gates (edge smoke checks, pod-restart and readiness checks, and an HTTP 5xx-ratio gate). Database migrations take an automatic snapshot first. Rollback is a re-promotion that was rehearsed in dev.
A test: open your last five production changes. Each should have a pull request with an approver, a pipeline run and the identifier of what was deployed. A change with no trail is the one the auditor will find.
What does an audit ask about logging and monitoring?
That you know when something is wrong and can show what you did. An alert that has never fired is a guess. On a portfolio-analytics SaaS platform each alert was tested until it fired, and production went from no alert rules to 275. The same idea is in our SRE and observability package: metrics, logs and traces wired, 3 SLOs defined, alerts proven to fire and a runbook.
What the auditor will want to see is boring: the alert definition, the proof it fired, the ticket or incident record, and the runbook that was followed. Decide who is allowed to read and change the logs, and keep that evidence too.
What does an audit ask about infrastructure as code?
That infrastructure is defined in code, changed through review and not edited by hand in a console. Then every infrastructure change has a diff, an approver and a date, which is what the sample asks for.
On our work, infrastructure is code with OpenTofu or Terraform and encrypted state, a plan is read before it applies, and destructive changes hit a brake before they run. On a portfolio-analytics SaaS platform, changes go through Terraform and OpenTofu with Atlantis, which runs the plan on the pull request. CI/CD and infrastructure as code in two weeks walks through the setup, and OpenTofu versus Terraform covers the tool choice.
What can’t an engineering partner do for you?
The part that is not engineering. Policies, risk assessments, HR checks, vendor reviews and the choice of auditor are yours. We don’t offer 24x7 on-call, so the incident response that an auditor tests is your own team’s, with the alerts and runbooks we leave. And no package on our price list makes you compliant. The CI/CD & IaC package (USD 4,000 for 2 weeks) builds the push gate, state, plan brake and deploy by digest. The SRE / Observability Foundations package (USD 5,000 for 2 weeks) builds the alerts and the runbook. They produce the evidence. Whether it is enough is the CPA firm’s call.
By the hour, a Senior engineer is USD 45 to 50 and a Lead or Architect USD 55 to 60. See the pricing page, and the post on Argo CD and Kargo for how the promotion gates work.
What should you do first?
Pick one of two 30-minute exercises. List everyone with access to production today and compare it with your HR roster. Or take your last five production changes and check that each has an approver, a pipeline run and a deployed identifier. Whichever one is harder to answer is your first control.
Sources
- AICPA & CIMA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022): the page describes the criteria for security, availability, processing integrity, confidentiality and privacy. The document itself needs a free AICPA account, so I cite the description and not the criteria text. Retrieved 2026-10-09 (sha256 ea5a9da2…).
- AICPA & CIMA, System and Organization Controls (SOC) suite of services: SOC services are offerings CPAs may provide. Retrieved 2026-10-09 (sha256 7c990af6…).
- Our case: fintech release pipeline, for the vulnerability gate, the promotion pipeline, the alerts and the Atlantis workflow. The Type I and Type II summary is my own and not from these pages.