SOC 2 on AWS: a practical checklist
A control-by-control guide for AWS-hosted SaaS preparing for SOC 2 Type I or Type II. Every item cites the Trust Services Criterion it satisfies and the AWS command an auditor will ask you to run. No fluff, no upsell — the same checklist we use on ourselves.
Updated 2026-04-19 · ~10 minute read
Who this is for
1-50 person SaaS teams running on AWS, with an enterprise prospect asking for a SOC 2 report in the next 3-6 months. If you have a dedicated compliance team running a vendor program, skim the AWS-specific rows and ignore the commentary. If you're a founder + CTO pair scrambling to pass, read top-to-bottom.
What SOC 2 actually is (one paragraph)
SOC 2 is an AICPA audit framework. A CPA firm signs a report saying your security controls operate as described, across five Trust Services Criteria: Security (CC1-CC9 — the only mandatory one), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P). Type I is a point-in-time snapshot. Type II covers a window — typically 3-12 months — and is what enterprise buyers expect.
How CloudArq groups the gaps by criterion
Each failing control ships with a copy-paste CLI / Terraform fix and its evidence pointer for the auditor.
Frequently asked
- 01How long does a SOC 2 audit take for a SaaS on AWS?
- SOC 2 Type I takes 2-6 weeks once evidence is in place. Type II requires a 3-12 month observation window — the auditor watches your controls operate over that period before issuing the report.
- 02Do we need to switch clouds to pass SOC 2?
- No. SOC 2 is cloud-agnostic. AWS, Azure, and GCP all publish a SOC 2 Type II report for their own infrastructure; you inherit their physical-security and hypervisor controls and document the controls you operate on top.
- 03Which SOC 2 trust-services criteria apply to an AWS-hosted SaaS?
- Security (CC1-CC9) is required for every SOC 2. Availability (A1) is required if you commit to uptime in a customer contract. Confidentiality (C1), Processing Integrity (PI1), and Privacy (P) are elective — pick them if you handle regulated data or advertise specific claims.
- 04Do we need a security vendor to pass SOC 2?
- Not strictly, but most small teams use one of: Vanta / Drata / Secureframe for the program + evidence, plus a CPA firm (A-LIGN, Johanson, Prescient, BDO) as the auditor. CloudArq covers the AWS-infrastructure evidence side; the vendor covers policy templates, employee training, and the audit-management workflow.
- 05What are the top-3 AWS misconfigurations that block SOC 2?
- CloudTrail disabled in a region, public S3 buckets holding customer data, and security groups allowing 0.0.0.0/0 on SSH or RDP. Every one of these is a CC6.6 or CC7.2 failure and auditors will find them on day one.
- 06How much does SOC 2 cost?
- Budget $15K-40K for a Type I report from a mid-tier CPA firm for a 1-50-person company. Type II runs $25K-60K. Ongoing (renewal + continuous compliance) adds $5K-20K/year. Security vendor subscriptions add $10K-40K/year on top.