Frameworks · SOC 2 Type I & Type II
The deal is waiting
on your SOC 2.
A big customer asked for your “SOC 2 report” and the deal went quiet. Here's what they mean: they won't buy until an independent auditor confirms you keep customer data safe. Lionfish gets you audit-ready — the Cyber Tackle Box™ platform organizes the controls, evidence, and training — and if you want more than software, Lionfish & partner consultants do the heavy lifting while your engineers stay on the product. You walk into the audit prepared, the auditor issues the report, and the deal moves again.
Technical evaluator? Skip the pitch — jump to the deep dive ↓
For the technical reader — the deep dive
- ▸Basis: AICPA 2017 Trust Services Criteria with the 2022 revised points of focus (TSP §100); five categories — Security (mandatory), Availability, Processing Integrity, Confidentiality, Privacy.
- ▸Type I attests control design at a point in time; Type II attests operating effectiveness over a 3–12-month observation window.
- ▸Deliverable is an attestation report from a licensed CPA firm — not a certificate; it must be re-issued annually to stay current in procurement.
- ▸Typical specialist-firm audit fees: $15K–$70K for Type II; readiness scope drives the fee more than headcount does.
- ▸In the Tackle Box: TSC-mapped controls and policies, evidence at the control level, and cross-mapping so the same evidence serves ISO 27001 and HIPAA.
Want to go deeper than a web page? Book a call — you'll be talking to a practitioner, not a salesperson.
What SOC 2 really costs — and really pays
Sources: AICPA TSP 100; soc2auditors.org 171-firm fee dataset; Secureframe compliance benchmark surveys (vendor-published). Your numbers depend on scope — we'll estimate them free on the first call.
Who this is for
Built for the team that has revenue on the line
SOC 2 isn't a legal mandate — it's a sales gate. It lands on you the day a big customer's security team says "send the report."
- ✓B2B SaaS founders and CTOs with an enterprise deal (or a whole pipeline) stalled in security review — and no dedicated security hire.
- ✓Scale-ups with a first security hire who needs leverage: one person can't write 30 policies, chase evidence, and run awareness training alone.
- ✓MSPs, fintechs, and data processors whose customers' auditors are now asking about the vendors' vendors.
Sound familiar?
The pain we hear on every first call
- !The questionnaire graveyard. Every stalled security review costs weeks of pipeline — and the same questions come back on every deal.
- !Checkbox tools left you alone. Automation platforms collect evidence, then leave you to interpret findings, fix gaps, and face the auditor solo.
- !It never ends. Type II renews every year. Without a system of record, next year's audit starts from scratch.
The platform
How the Cyber Tackle Box™ runs your SOC 2 program
One platform runs the whole program — and the same evidence backbone serves ISO 27001, HIPAA, and NIST when your customers ask for those next.
Policy Templates
The 20–40 policies auditors expect, pre-built and mapped to the Trust Services Criteria — tailor them to your stack instead of writing from a blank page.
Objectives
Every criterion tracked against a target date and an owner, so "are we ready for the audit?" has a live, honest answer.
Remediation & POA&Ms
Gaps become assigned, dated work items driven to closure — not rows in a spreadsheet nobody opens.
Evidence, Organized
Controls, artifacts, and screenshots in one system of record your auditor can follow — timestamped, assigned, exportable.
Playbooks
Step-by-step runbooks for onboarding, access reviews, incident response, and vendor management — the operational proof Type II demands.
Training Built In
Security awareness training your auditor will actually credit — 52 modules including music-based training people finish — inside the same platform.
Software, services, or both
Two ways to work with Lionfish
The Cyber Tackle Box™ is a product you can run yourself. Our consulting team is a service you can add. Take either — or both. They're priced separately, and we'll tell you straight which one you actually need.
The platform — Cyber Tackle Box™
Software you run yourself: framework-mapped controls, policy templates, evidence, POA&Ms, and workforce training in one system of record. Your team (or your MSP) drives; the platform keeps everything organized and audit-ready.
Book a platform demoThe services — Lionfish & partner consultants
Add Lionfish & partner consultants — led by the team that trains certified CMMC assessors, backed by our vetted Trusted Partner Network — to run the gap assessment, drive remediation, and prepare you for the audit, by, with, and through your team, inside the same platform.
Book a readiness callFor MSPs & partners
Multi-tenant by design: run every client's compliance program from one console and add a services line without adding headcount. White-glove onboarding for your first clients.
Partner with usStraight answers
SOC 2 questions we answer every week
How much does a SOC 2 audit cost?
Audit fees alone typically run $15K–$70K for a Type II with a specialist firm, and total first-year programs commonly land between $30K and $150K including readiness, tooling, and internal time. Right-sized preparation is the biggest lever: showing up ready cuts both the audit scope and the consultant hours. We scope your real number free on a 30-minute call.
What's the difference between SOC 2 Type I and Type II?
Type I is a point-in-time report on whether your controls are designed properly. Type II tests whether they actually operated over a window of typically 3–12 months — which is why enterprise customers usually insist on Type II, and why the calendar, not the paperwork, sets your timeline. Many companies do Type I first to unblock a deal, then roll into Type II.
How long does SOC 2 take?
Type I: roughly 3–8 months end to end. Type II: 6–20 months, because the observation window is a hard floor. The practical answer: start the program the week the first enterprise prospect asks, not the quarter the deal is dying.
We already use Vanta/Drata — why Lionfish?
Automation platforms are good at collecting evidence and bad at everything that actually fails audits: interpreting findings, writing defensible policies, changing employee behavior, and answering the auditor's follow-ups. Lionfish pairs the platform with practitioners who work by, with, and through your team — and our training is real curriculum from a state-accredited school, not a checkbox LMS.
Get in touch
Get your SOC 2 moving this week
Tell us about the deal that's waiting and the stack you run. You'll get a straight readiness estimate — timeline and budget — within one business day.
- 1We reply within one business day — usually faster.
- 2A 30-minute call with someone who can actually answer your questions.
- 3A straight recommendation — even if it's that you don't need us yet.
Prefer to skip the form? Book a time directly or call 1-877-732-6772.