SOC 2 for US MSPs and IT Services Firms: What Buyers Require

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome: a SOC 2 report your prospects' security teams accept in place of a fresh questionnaire, ready in time for the deal that triggered the request. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require^[3]. Sterling coordinates every step up to that report, so you deal with one team throughout.

Your technicians hold admin rights, your RMM can push code to every client device, and your tickets collect network diagrams. US buyers know it, and three situations put the report on the table.

• US clinics, health plans and their vendors. A HIPAA covered entity may let a business associate create, receive, maintain or transmit electronic protected health information on its behalf only after obtaining satisfactory assurances that it will safeguard that information^[5]. In Sterling's experience, a SOC 2 report is the assurance their compliance teams prefer to read.
• US financial firms under the FTC Safeguards Rule. They must select capable service providers, bind them by contract and assess them periodically based on risk^[4].
• US mid-market and enterprise buyers. In Sterling's experience, a multi-year managed services contract now often carries a clause requiring an independent report within a stated period after signature.

The outcome: a system description built around the service line your US buyer is purchasing, with nothing in it you cannot evidence.

• The service. Managed endpoints, a 24x7 service desk, managed backup or co-managed security, named as the buyer knows them.
• The tooling. RMM, PSA and ticketing, remote access, scripting, the password vault, and any cloud hosting behind them.
• Identity. Staff accounts and every privileged path into client environments.
• Your workplace. Laptops, mail, files and the remote-work rules for technicians across US states and any offshore desk.
• Vendors you rely on. Each named, then stated as either inside the testing or described and left outside it.

On the Trust Services Criteria, security is always in scope; availability, processing integrity, confidentiality and privacy are the further categories^[1]. Most MSPs add availability for their uptime and response commitments and confidentiality for the client data they hold. We settle the selection against your contracts at the gap assessment.

The outcome: the samples a CPA firm pulls come back clean. These are Sterling's own descriptions of the areas that carry the weight.

1. Privileged access. No shared admin logins, multi-factor sign-in, and proof that access ended when a contract or employee did. Reviewers pick tickets and ask who touched the system. 2. Tenant separation. One client's credentials and scripts cannot be reached through another's records. 3. Tooling changes. RMM policies, agents and scripts reviewed and recorded before release. 4. Joiners and leavers. Background checks as state law allows, signed confidentiality terms, training, and same-day removal of access. High help-desk turnover is where exceptions appear. 5. Restores, not just backups. If you promise availability, show a tested restore. 6. Incident response. A contact tree for notifying each client, exercised and recorded. 7. Vendor oversight. The suppliers whose failure would stop your service, with their own assurance reports reviewed.

The outcome: we remove these delays before the CPA firm's fieldwork starts.

• The portal in scope, the technicians' tools left out. Buyers worry most about the tools.
• Shared admin accounts. Retire them before the observation period opens.
• "We do that every quarter" with nothing saved. The CPA firm tests records.
• Contract and overnight technicians missing from HR lists. Then the access review misses them too.
• A description that overpromises. If it says every change is peer reviewed, every sampled change needs a reviewer.
• Planning from the standard, not the deadline. When a signed contract sets the report date, work back from it. Whether a client will accept a point-in-time report or needs one covering a period is a question we put to them early, for you.

The outcome: a SOC 2 report on the date your contract needs it, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you.

1. Free gap assessment. We review services, tools and practice, recommend scope and criteria, and list the gaps in plain language. 2. Control design. We write policies and procedures that describe how your technicians already work. 3. Fixes. We guide the remediation: retiring shared accounts, tightening access reviews, building the offboarding checklist. 4. Readiness. Effivity, our GRC automation platform, gathers the evidence, and our internal review finds surprises before the CPA firm does. 5. The report. We coordinate scheduling, evidence requests and follow-up questions with the CPA firm until the report is issued.

Need the report for a signed contract? Choose Get a proposal and a Sterling expert will reply with a dated plan.

A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require^[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.

With Sterling, you deal with one team from start to finish. We coordinate:

• a readiness review and a gap assessment against the Trust Services Criteria;
• the policies, procedures and controls you need, written for how your company actually works;
• evidence collection, so the examination does not become a scramble;
• an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
• the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.

Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.

^[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.

• SOC 2: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• SOC 2 Timeline for US Start-ups: How Long Each Stage TakesUnited States
• SOC 2 vs ISO 27001 for US Companies: Which to Start WithUnited States
• ISO/IEC 27001 for US MSPs and IT Services Firms: What Clients RequireUnited States
• PCI DSS for US MSPs and IT Services Firms: What Merchant Clients RequireUnited States
• Sterling in the United StatesUnited States

1. 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus, 2022). AICPA & CIMA. accessed October 23, 2026.

2. System and Organization Controls: SOC Suite of Services. AICPA & CIMA. accessed October 23, 2026.

3. System and Organization Controls: SOC Suite of Services (AICPA role in SOC standards; licensing of practitioners). AICPA & CIMA. accessed October 23, 2026.

4. 16 CFR Part 314, Standards for Safeguarding Customer Information (Safeguards Rule), sections 314.1 and 314.4(f) (oversee service providers). eCFR (Office of the Federal Register). accessed October 26, 2026.

5. 45 CFR 164.308 Administrative safeguards, paragraph (b)(1) (business associate contracts and other arrangements). eCFR (Office of the Federal Register). accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.