SOC 2 Compliance for SaaS in the US: Document Security, Controls and Audit Readiness

SOC 2 compliance is a US-native standard — and in the American market, it is the primary security credential enterprise buyers demand from SaaS vendors. A SOC 2 Type II report under AICPA's SSAE 18 attestation standard proves your controls operated effectively for 6 to 12 months. For SaaS companies in fintech, healthcare, legal, or government sectors, SOC 2 intersects directly with federal requirements from FinCEN, the Bank Secrecy Act (BSA), OFAC sanctions programs, and state-level privacy laws including the California Consumer Privacy Act (CCPA).

This article is for informational purposes only and does not constitute legal or regulatory advice. Regulatory references are accurate as of publication. Consult an accredited CPA firm and qualified legal counsel for advice specific to your situation.

What is SOC 2 compliance in the United States?

SOC 2 was developed by the AICPA under attestation standard SSAE 18, replacing the earlier SSAE 16 in 2017. It evaluates service organisations against five Trust Services Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy.

SOC 2 is the de facto security standard for US SaaS procurement. The Security criterion (Common Criteria, CC) is mandatory; the other four are selected based on service commitments. Two report types exist:

A SOC 2 Type I is regularly used to unlock early-stage enterprise pilots, but virtually every Fortune 500 vendor qualification process requires Type II. The AICPA publishes the authoritative TSC framework at aicpa-cima.com.

SOC 2 and US federal regulatory alignment

FinCEN and the Bank Secrecy Act (BSA)

For SaaS platforms that process financial transactions, customer identity data, or support anti-money laundering (AML) workflows, SOC 2 operates alongside FinCEN (Financial Crimes Enforcement Network) requirements under the Bank Secrecy Act (31 USC §5311). The BSA's recordkeeping requirements — including the retention of Customer Identification Program (CIP) records for five years after account closing — directly intersect with SOC 2 confidentiality and availability controls.

FinCEN's 2016 Customer Due Diligence Rule (31 CFR 1010.230) requires covered financial institutions to verify the identity of beneficial owners of legal entity customers. SaaS platforms supporting CDD workflows must demonstrate document security controls consistent with both SOC 2 and BSA obligations.

OFAC sanctions screening

SaaS platforms used by financial institutions for customer onboarding or payment processing must integrate OFAC (Office of Foreign Assets Control) sanctions list screening. OFAC administers over 30 sanctions programs; violations can result in civil penalties up to $1,094,010 per violation as of 2024 (OFAC Civil Penalties). SOC 2 controls around data accuracy (Processing Integrity criterion) and system availability are directly relevant to sanctions screening reliability.

Corporate Transparency Act (CTA) 2021

The Corporate Transparency Act (effective January 1, 2024, enforcement pending litigation) requires millions of US entities to report beneficial ownership information to FinCEN. SaaS platforms that collect and store beneficial ownership documents must implement SOC 2-consistent controls for document integrity, encryption, and retention.

State privacy laws: CCPA, CPRA, and beyond

The California Consumer Privacy Act (CCPA), as amended by the CPRA (California Privacy Rights Act, effective January 1, 2023), imposes obligations on SaaS companies processing personal data of California residents. The CPRA created the California Privacy Protection Agency (CPPA) as the dedicated enforcement body. SOC 2's Privacy criterion covers key CCPA/CPRA obligations including data subject rights, retention limits, and vendor contracts.

As of 2026, 20 US states have enacted comprehensive privacy laws. SaaS companies should map their SOC 2 Privacy criterion implementation against state-by-state requirements, using resources from the International Association of Privacy Professionals (IAPP).

Document security controls critical for US SaaS

Encryption standards and FedRAMP context

US federal contractors and SaaS vendors targeting government agencies must meet NIST SP 800-53 and FedRAMP standards alongside SOC 2. For document data, this means AES-256 encryption at rest and TLS 1.3 in transit, with FIPS 140-2 validated cryptographic modules where federal contracts are involved.

SOC 2 and FedRAMP overlap significantly in their encryption and access control requirements, though FedRAMP is more prescriptive. A SOC 2 Type II report can support — but does not replace — FedRAMP authorization.

Access controls and the principle of least privilege

Under SOC 2 sub-criterion CC6, every user and service account must have the minimum access required for their role. For US SaaS companies, this aligns with IRS Publication 1075 requirements for tax data, HIPAA minimum necessary standards for health information, and SOX Section 404 internal control requirements for publicly traded companies.

Immutable audit trails and recordkeeping

For US SaaS in regulated sectors, document access logs serve dual purposes: SOC 2 Type II evidence and regulatory recordkeeping. BSA-covered entities must retain certain records for five years; HIPAA requires six years from date of creation or last effective date; SEC Rule 17a-4 requires electronic record retention for three to seven years depending on record type.

An automated document validation solution can centralise these trails, apply retention rules by data classification, and export records in SEC-compliant WORM (Write Once Read Many) format.

Preparing for a SOC 2 Type II audit in the US

Step 1 — Scope and gap analysis

Define your system description and conduct a gap analysis against AICPA Common Criteria. US-focused SOC 2 automation platforms (Vanta, Drata, Secureframe, Thoropass, Strike Graph) typically include pre-built integrations for AWS GovCloud, Azure Government, and common US SaaS stack components.

Step 2 — Remediate control gaps

Most common gaps in US SaaS pre-audit assessments:

• No formal sub-processor agreement process (violates CC9.2)
• Vendor risk assessments not documented (SOC 2 + third-party risk)
• Penetration testing not performed by a CREST-accredited or equivalent firm annually
• Incident response plan not tested with tabletop exercises

Step 3 — CPA firm selection

Your SOC 2 auditor must be an AICPA-licensed CPA firm. Approximately 400 firms in the US are qualified to perform SOC 2 examinations. Cost for a first Type II ranges from $20,000 to $80,000 for a focused SaaS scope, and $80,000–$200,000 for complex multi-criteria, multi-region engagements. See our guide on building a document compliance programme from scratch for pre-audit preparation steps.

Step 4 — Managing the observation period

The 12-month observation period is the main operational burden. Every control must produce dated, repeatable evidence. Common pitfalls: manual evidence collection that breaks during team turnover, policy documents that drift out of date, and vendor questionnaire responses that don't reflect actual controls.

SOC 2 vs ISO 27001 vs FedRAMP in the US context

For US commercial SaaS, SOC 2 Type II is the baseline. Layer ISO 27001 for European expansion and HIPAA attestation if processing protected health information.

Cost and return on investment

A SOC 2 Type II report generates on average 3.2x its cost in unlocked commercial opportunities according to Vanta's 2024 State of Trust Report (vanta.com).

Typical first-year cost components for a US SaaS:

• CPA audit fee: $25,000–$100,000
• Pre-audit technical remediation: $10,000–$40,000
• Automation platform: $10,000–$30,000 per year
• Internal time (engineering + compliance): 200–400 hours

Timeline: 9–14 months for a first Type II from project kick-off to report delivery; 3–4 months for annual renewals.

FAQ

What is SOC 2 compliance for US SaaS companies?

SOC 2 is an AICPA attestation framework (SSAE 18) that evaluates a SaaS provider's security, availability, processing integrity, confidentiality, and privacy controls. A Type II report covering a 6–12 month observation period is the standard US enterprise procurement requirement.

Does SOC 2 satisfy FinCEN and BSA requirements?

No. SOC 2 addresses the security of your systems; FinCEN and BSA impose substantive AML/CFT obligations including customer identification, beneficial ownership verification, suspicious activity reporting (SARs), and transaction recordkeeping. A SOC 2-compliant SaaS still requires its customers to maintain their own BSA compliance programs.

Is SOC 2 required by law in the United States?

SOC 2 is not mandated by any US federal statute. It is a contractual requirement imposed by enterprise buyers during vendor qualification. However, certain sectors layer on regulatory requirements: HIPAA for health data, GLBA/SOX for financial data, and FedRAMP for federal agencies.

How long does a SOC 2 Type II audit take in the US?

The observation period itself is 6–12 months. Adding preparation (3–6 months gap analysis and remediation) and auditor fieldwork (6–12 weeks), expect 9–18 months from project start to report delivery for a first-time Type II.

What is the difference between SOC 2 and CCPA compliance?

SOC 2's Privacy criterion addresses technical and operational privacy controls. CCPA compliance is a legal obligation specific to personal data of California residents — covering consumer rights (opt-out, deletion, access), data broker registration, and specific contractual requirements with service providers. Both are required for California-operating SaaS companies that handle personal data.