SOC 2 compliance is increasingly a requirement for selling to enterprise customers. 82% of enterprise procurement teams require SOC 2 Type II reports from SaaS vendors according to the 2026 Vanta compliance survey. This guide maps SOC 2 Trust Service Criteria to specific cloud infrastructure controls, shows how to automate evidence collection, and provides a preparation checklist for both Type I and Type II audits.
The average SOC 2 audit costs $20,000-50,000 for a startup. The infrastructure preparation typically takes 3-6 months for Type I and 6-12 months for Type II. Teams that automate evidence collection reduce preparation time by 60% and ongoing compliance effort by 75%.
---
SOC 2 Trust Service Criteria Mapped to Infrastructure
SOC 2 has five Trust Service Criteria (TSC). Security is mandatory; the rest are optional but commonly included.
| Criteria | Required | Typical for SaaS | Key Infrastructure Controls |
| Security | Yes | Yes | Access control, encryption, monitoring |
| Availability | Optional | Yes | Uptime SLA, redundancy, backups |
| Processing Integrity | Optional | Sometimes | Data validation, error handling |
| Confidentiality | Optional | Yes | Encryption at rest/transit, access logs |
| Privacy | Optional | If handling PII | Data lifecycle, consent management |
---
Security Controls for Cloud Infrastructure
Access Control (CC6.1 - CC6.8)
<h1>access-control-policy.yaml</h1>
controls:
authentication:
- mfa_required: true # All users, no exceptions
- password_policy:
min_length: 12
require_uppercase: true
require_number: true
require_special: true
max_age_days: 90
- session_timeout_minutes: 30
- failed_login_lockout: 5 # Lock after 5 failed attempts
authorization:
- rbac_model: role_based
- principle: least_privilege
- roles:
admin: full_access # 2-3 people maximum
developer: deploy_and_read # Most engineers
viewer: read_only # Stakeholders
- access_reviews: quarterly # Review and remove unused access
infrastructure_access:
- ssh_keys_only: true # No password auth for servers
- bastion_host: required # No direct SSH to production
- vpn: required_for_admin_panels # Admin interfaces behind VPN
- api_keys: rotated_every_90_days
Encryption (CC6.1, CC6.7)
| Data State | Encryption Standard | Implementation |
| In transit | TLS 1.2+ (prefer 1.3) | nginx/load balancer termination |
| At rest (database) | AES-256 | PostgreSQL TDE or disk encryption |
| At rest (storage) | AES-256 | Object storage server-side encryption |
| At rest (backups) | AES-256 | Encrypted backup archives |
| Secrets | AES-256 | Vault or secrets manager |
<h1>Verify TLS configuration</h1>
nmap --script ssl-enum-ciphers -p 443 your-app.arxentra.cloud
<h1>Expected: TLS 1.2 and 1.3 only, no TLS 1.0/1.1</h1>
<h1>Expected: Strong cipher suites (AES-256-GCM, CHACHA20-POLY1305)</h1>
Monitoring and Logging (CC7.1 - CC7.4)
<h1>monitoring-requirements.yaml</h1>
logging:
- access_logs: enabled # All HTTP requests
- audit_logs: enabled # All admin actions
- database_logs: enabled # All DDL, failed queries
- authentication_logs: enabled # All login attempts
- retention_days: 365 # 1 year minimum for SOC 2
- tamper_protection: true # Logs cannot be modified/deleted
alerting:
- unauthorized_access_attempts: immediate
- privilege_escalation: immediate
- configuration_changes: within_1_hour
- failed_backup: within_1_hour
- certificate_expiry: 30_days_before
- unusual_data_access: within_1_hour
review:
- log_review: weekly
- alert_triage: daily
- incident_response_drill: quarterly
Arxentra provides built-in audit logging and monitoring. See Services Overview for compliance-ready infrastructure options.
---
Evidence Collection Automation
Auditors need evidence that controls are operating effectively. Automate evidence collection to avoid the annual audit scramble.
Evidence Types and Sources
| Control | Evidence Type | Automated Source | Collection Frequency |
| Access control | User list with roles | Identity provider API | Monthly |
| MFA enforcement | MFA enrollment report | Auth provider dashboard | Monthly |
| Encryption in transit | TLS scan results | SSL Labs API | Weekly |
| Encryption at rest | Database config | PostgreSQL settings query | Monthly |
| Backup verification | Restore test results | Automated restore script | Monthly |
| Vulnerability scanning | Scan reports | Trivy/Grype CI/CD output | Per deploy |
| Uptime | Availability metrics | Monitoring dashboard export | Monthly |
| Incident response | Incident post-mortems | Incident management tool | Per incident |
| Access reviews | Review completion log | Access review tool | Quarterly |
<h1>Automated evidence collection script (run monthly via cron)</h1>
#!/bin/bash
EVIDENCE_DIR="evidence/$(date +%Y-%m)"
mkdir -p "$EVIDENCE_DIR"
<h1>1. User access list</h1>
curl -s https://api.arxentra.cloud/v1/team/members \
-H "Authorization: Bearer $API_TOKEN" \
> "$EVIDENCE_DIR/user-access-list.json"
<h1>2. TLS scan</h1>
ssllabs-scan --quiet your-app.arxentra.cloud \
> "$EVIDENCE_DIR/tls-scan.json"
<h1>3. Vulnerability scan of production image</h1>
trivy image --format json registry.arxentra.cloud/myapp:production \
> "$EVIDENCE_DIR/vulnerability-scan.json"
<h1>4. Backup verification</h1>
pg_restore --list latest-backup.dump \
> "$EVIDENCE_DIR/backup-verification.txt"
<h1>5. Uptime report</h1>
curl -s "https://api.monitoring.tool/v1/uptime?period=month" \
> "$EVIDENCE_DIR/uptime-report.json"
echo "Evidence collected: $(ls $EVIDENCE_DIR | wc -l) files"
---
Audit Preparation Checklist
Type I (Point in Time)
- [ ] All policies documented and approved
- [ ] Access control configured and evidenced
- [ ] Encryption at rest and in transit verified
- [ ] Monitoring and alerting operational
- [ ] Backup procedures documented and tested
- [ ] Incident response plan documented
- [ ] Vendor management policy in place
- [ ] Employee security training completed
- [ ] Risk assessment documented
- [ ] Change management process defined
Type II (Over a Period, Typically 6-12 Months)
All Type I requirements, plus:
- [ ] 6-12 months of continuous evidence
- [ ] Quarterly access reviews completed
- [ ] Monthly backup restore tests documented
- [ ] All incidents documented with post-mortems
- [ ] Vulnerability scan results for the entire period
- [ ] Change management records for all deployments
- [ ] Employee onboarding/offboarding records
- [ ] Annual risk assessment update
---
Timeline to SOC 2 Compliance
| Phase | Duration | Activities |
| Gap assessment | 2-4 weeks | Identify missing controls |
| Remediation | 2-4 months | Implement missing controls |
| Type I readiness | 2-4 weeks | Final evidence collection |
| Type I audit | 2-4 weeks | Auditor assessment |
| Observation period | 6-12 months | Continuous operation |
| Type II audit | 4-6 weeks | Auditor reviews full period |
Total: 12-18 months from start to Type II report. Visit Pricing for compliance-ready infrastructure pricing.
---
Frequently Asked Questions
Do I need SOC 2 if I am a small startup?
If you sell to enterprise customers (companies with 500+ employees), yes. SOC 2 is increasingly a gate for procurement. Start with Type I (faster, cheaper) to unblock deals, then work toward Type II. Many startups complete Type I within 3-4 months.
How much does SOC 2 compliance cost?
Type I audit: $15,000-30,000. Type II audit: $25,000-50,000. Compliance automation tools (Vanta, Drata, Secureframe): $10,000-25,000/year. Infrastructure changes: varies. Total first-year cost for a startup: $40,000-80,000. The cost is offset by the ability to close enterprise deals.
Can I use my cloud provider's SOC 2 report instead of getting my own?
No. Your cloud provider's SOC 2 covers their infrastructure, not your application or processes. You need your own SOC 2 that covers how you build, deploy, and operate your software. Your provider's SOC 2 can be referenced as a complementary report.
What is the difference between SOC 2 Type I and Type II?
Type I evaluates whether your controls are designed correctly at a specific point in time. Type II evaluates whether your controls operated effectively over a period (typically 6-12 months). Enterprise customers strongly prefer Type II. Type I is useful as an interim step.
Does my managed infrastructure provider handle SOC 2 for me?
Partially. Managed infrastructure (like Arxentra) handles physical security, network security, and host-level controls. You are still responsible for application-level controls: access management, data encryption, monitoring, incident response, and change management. See Documentation for shared responsibility model details.
How often do I need to renew SOC 2?
SOC 2 Type II reports cover a specific observation period and need to be renewed annually. Most companies run continuous audits with their auditor to maintain an unbroken chain of compliance. Budget for annual audit costs in your operating expenses.