What a SOC 2 Consultant Does
A SOC 2 consultant does everything that has to be true before a CPA firm can issue a clean report — and nothing the CPA firm does. The split is not a convention; it is a rule of the attestation standard.
Concretely, the work is:
Scope. Which of the five Trust Services Criteria you actually need, which systems and which legal entity, decided from what your customer asked for rather than from what sounds thorough.
Gap assessment. Every control in scope, tested against what you have today, with a findings register and a costed plan. This is the readiness assessment, and it is where most engagements start.
Remediation. Policies written, procedures documented, and — the larger part — technical controls implemented alongside your engineers. Most of the calendar goes here.
Evidence. Setting up collection so the observation window produces what the auditor will ask for, rather than a scramble the week before fieldwork.
Audit preparation. Populations built from the system of record, samples ready, the system description written, and your team briefed on what the PBC list will look like.
What a SOC 2 Consultant Cannot Do
Issue the report. Only a licensed CPA firm can, and independence rules mean it cannot be the same firm that prepared you. We do readiness; a CPA firm does the audit; you receive two invoices from two organizations. Any provider offering to take you "end to end through SOC 2 certification" is either describing a referral or describing something that is not a SOC 2 report.
Shorten the observation window. A Type 2 tests a period, and the period has to happen. No consultant can compress three months into one.
Guarantee a clean opinion. The auditor samples and decides. Good preparation makes exceptions unlikely; it cannot make them impossible.
If a provider promises any of those three things, that is the moment to ask which of the two roles they occupy.
When You Need One
| Situation | A consultant is |
|---|---|
| First SOC 2, no one on the team has done one | The difference between six months and twelve |
| A deal is contingent on the report and the clock is running | Worth it for the scoping decision alone |
| You run a compliance platform and the dashboard is green, but you have never met an auditor | Usually needed for the system description and evidence review |
| Renewal, same scope, same team as last year | Probably not needed |
| Security lead who has shipped two SOC 2 reports elsewhere | Not needed |
What the Engagement Looks Like
| Week | What happens | What you receive |
|---|---|---|
| 1–2 | Scoping workshop, system inventory, criteria decision | Written scope, agreed |
| 2–4 | Gap assessment against every control in scope | Findings register, costed remediation plan |
| 4–12 | Remediation with your engineers; policies and procedures written | Controls running; document set |
| Ongoing | Evidence collection set up and monitored through the window | Evidence trail the auditor can sample |
| Pre-fieldwork | Populations reconciled, samples prepared, system description drafted | Audit-ready pack |
| Fieldwork | We are available to your team while the CPA firm tests | Exceptions handled as they arise |
The engagement is capped at 90 days. That is a published maximum, not an estimate, and it is the number to hold any provider to.
Consultant vs Platform vs Doing It Yourself
| Consultant | Platform (Vanta, Drata, Sprinto) | DIY | |
|---|---|---|---|
| Decides your scope | Yes | No — you configure it | You |
| Writes policies that fit your business | Yes | Templates | You |
| Implements technical controls | With your engineers | Monitors; does not implement | Your engineers |
| Explains why evidence was rejected | Yes | No | You work it out |
| Recurring cost | No — engagement ends | Annual subscription | None |
| Best for | First report, deal pressure, complex scope | Ongoing monitoring after the first report | Experienced security lead |
These are not alternatives so much as different stages. A platform is a good way to keep compliance; it is not a substitute for the judgement the first report needs. See passing SOC 2 when you already run a platform and the Vanta, Drata and Sprinto comparisons.
What It Costs
Two invoices from two organizations. Avantcert readiness ranges, already discounted 30–50% below typical market rates:
| Tier | Employees | Avantcert readiness | CPA audit fee | Max duration |
|---|---|---|---|---|
| Startup | 5–50 | from $7,000 | Separate | 90 days |
| Mid-Market | 51–200 | around $16,000 | Separate | 90 days |
| Large Enterprise | 201–500 | up to $25,000 | Separate | 90 days |
Full breakdown, including what drives the CPA fee, in SOC 2 certification cost. For a figure against your actual scope, use the estimator.
SOC 2 for Indian Companies
SOC 2 is what US and European enterprise customers ask Indian vendors for, and the report is exactly the same document wherever the company is based. It is issued by a licensed CPA firm under AICPA standards; your location does not change the criteria, the process or the result.
What does differ is context, and three points come up in nearly every Indian engagement:
The trigger is almost always export. An Indian SaaS company selling into the US hits SOC 2 at the first enterprise security review. Domestic customers more often ask for ISO 27001. Many Indian companies end up needing both, and the two share most of their controls — see ISO 27001 vs SOC 2.
The DPDP Act sits alongside it, not inside it. The Digital Personal Data Protection Act 2023 governs personal data of Indian data principals; SOC 2 covers the controls around whatever data your customers entrust to you. A SOC 2 report does not demonstrate DPDP compliance, and DPDP compliance does not produce a SOC 2 report. If you handle Indian personal data, you need to think about both, and the Privacy criterion of SOC 2 is where they touch.
Fieldwork can be on site. Several CPA-affiliated audit firms have India offices and perform fieldwork in person in Bangalore and Mumbai. Remote fieldwork is also standard and works well. Avantcert is headquartered in Bangalore and works with clients across India; the pages for SOC 2 in Bangalore and SOC 2 in Mumbai cover what is specific to each.
Get a Scoped SOC 2 Quote
Tell us which criteria your customer asked for and your headcount. Scoped estimate and a roadmap within 24 hours.
Our form could not load. Email your scope and headcount and you'll get the same estimate within 24 hours.
Email your requirements Open the full quote formSOC 2 Consultant FAQs
What does a SOC 2 consultant actually do?
A SOC 2 consultant scopes which Trust Services Criteria you need, assesses your current controls against them, writes the policies and procedures that are missing, helps your engineers implement the technical controls, sets up evidence collection for the observation window, and prepares you for the CPA firm’s fieldwork. The consultant does the preparation. The CPA firm does the audit.
Can a SOC 2 consultant also perform the audit?
No. Independence is required under the AICPA attestation standards, so the firm that designs or remediates your controls cannot issue an opinion on them. Readiness and the audit always come from two separate organizations. Any provider offering to take you end to end through SOC 2 is describing a referral, or describing something that is not a SOC 2 report.
Do I need a consultant if I already use Vanta or Drata?
Sometimes. A platform shows you which controls are green and red; it does not decide your scope, write your system description, tell you which of its policy templates actually fit your business, or explain why an auditor rejected a piece of evidence. Companies with a security lead who has been through SOC 2 before usually do not need a consultant on top of a platform. Companies going through it for the first time usually do.
How much does a SOC 2 consultant cost?
Avantcert readiness engagements run from $7,000 for a 5–50 employee company, around $16,000 at 51–200, and up to $25,000 at 201–500 or complex scope, on a 90-day maximum engagement. The CPA firm’s audit fee is separate and paid to them directly.
Can an Indian company get a SOC 2 report?
Yes, and many do, because SOC 2 is what US and European enterprise customers ask their vendors for. The report is issued by a licensed CPA firm under AICPA standards regardless of where your company is based. Several CPA-affiliated audit firms have India offices and can perform fieldwork on site in Bangalore and Mumbai; remote fieldwork is also standard.
How long does it take with a consultant?
Readiness and remediation typically run one to three months. A Type 1 report can follow within two to three months of starting. A first Type 2 realistically takes six to twelve months end to end, because the observation window itself runs three to twelve months and cannot be compressed by anyone.
Start with where you actually stand
A readiness assessment tells you the gap, the cost to close it, and the realistic date.