Amazon CloudWatch
- HIPAA §164.312(b)
- SOC 2 CC7.1, CC7.2
- PCI DSS 11.6.1
- ISO 27001 A.8.16
SOC 2 Type II on AWS
From Procurement Block to Signed Audit.
SOC 2 at a glance
Enterprise procurement asks for SOC 2 Type II in two minutes and waits six months for it. We build the AWS-native control set, evidence pipeline, and CPA-firm-ready package so the audit window is the only thing on the critical path.
Framework
Service Organization Control 2 — Type II
Version
AICPA Trust Services Criteria 2017 (amended 2022) — CC1.x through CC9.x; optional Availability, Processing Integrity, Confidentiality, Privacy categories
Regulator
American Institute of Certified Public Accountants (AICPA)
Assessor
Licensed CPA firm — must be AICPA-member; SOC 2 Type II requires a 3–12 month observation window
Scope
Any service organization that processes customer data — typical for B2B SaaS, fintech, healthtech, and enterprise platforms.
Who engages on SOC 2
- B2B SaaS founders blocked by enterprise procurement gates that require SOC 2 Type II
- Series B+ startups expanding into Fortune 500 deals
- Platform companies that have a SOC 2 Type I and now need Type II for renewal
- Multi-product companies adding new SaaS lines under an existing SOC 2 report
Audit once, evidence four frameworks
Pick the frameworks you are scoped for. The tiles below are the AWS services that produce evidence for each one, with the control IDs they answer. The ones in navy cover every framework you picked: set them up once and the same evidence serves every auditor.
Counts come from the control excerpts on our four framework pages, not from your audit scope. Start from HIPAA, SOC 2, PCI DSS or ISO 27001.
21
AWS services evidence the 10 SOC 2 controls we map.
41 AWS services in total, mapped across 36 controls.
Amazon Inspector
- HIPAA §164.308(a)(5)(ii)(B)
- SOC 2 CC6.8
- PCI DSS 6.2, 6.3.3, 11.3.1
- ISO 27001 A.5.7, A.8.28
AWS Backup
- HIPAA §164.312(c)(1)
- SOC 2 CC7.5
- PCI DSS 6.3.3
- ISO 27001 A.5.30, A.8.10
Amazon Detective
- HIPAA §164.308(a)(1)(ii)(D)
- SOC 2 CC7.4
- ISO 27001 A.8.16
Amazon GuardDuty
- HIPAA §164.308(a)(5)(ii)(B)
- SOC 2 CC6.8, CC7.1, CC7.2
- ISO 27001 A.5.7, A.8.16
AWS CloudTrail
- HIPAA §164.308(a)(1)(ii)(D), §164.312(b)
- SOC 2 CC6.2, CC7.4
- ISO 27001 A.8.2
AWS Config
- HIPAA §164.308(a)(1)(ii)(A), §164.312(b)
- SOC 2 CC7.1
- ISO 27001 A.5.23
AWS PrivateLink and VPC endpoints
- HIPAA §164.312(e)(1)
- SOC 2 CC6.7
- PCI DSS 1.3, 1.4
AWS Security Hub
- HIPAA §164.308(a)(1)(ii)(A), §164.308(a)(6)
- SOC 2 CC7.1, CC7.3
- ISO 27001 A.5.23, A.8.16
AWS Signer
- HIPAA §164.312(c)(1)
- SOC 2 CC6.8
- ISO 27001 A.8.24
AWS Systems Manager
- HIPAA §164.308(a)(6)
- SOC 2 CC7.3
- PCI DSS 6.3.3
IAM Access Analyzer
- HIPAA §164.308(a)(1)(ii)(A)
- SOC 2 CC6.1
- ISO 27001 A.5.15
IAM Identity Center
- HIPAA §164.312(a)(1)
- SOC 2 CC6.1, CC6.2, CC6.6
- ISO 27001 A.5.15, A.8.2
Amazon Cognito
- HIPAA §164.312(a)(1)
- SOC 2 CC6.6
Amazon Security Lake
- HIPAA §164.308(a)(1)(ii)(D)
- SOC 2 CC7.4
AWS Elastic Disaster Recovery
- SOC 2 CC7.5
- ISO 27001 A.5.30
AWS IAM
- HIPAA §164.312(a)(1)
- SOC 2 CC6.1, CC6.6
AWS Network Firewall
- SOC 2 CC6.7
- PCI DSS 1.2, 1.3
AWS Organizations and SCPs
- SOC 2 CC6.1, CC6.2
- ISO 27001 A.5.15, A.8.2
EventBridge
- HIPAA §164.308(a)(6)
- SOC 2 CC7.3
Step Functions
- HIPAA §164.308(a)(6)
- SOC 2 CC7.3
Amazon CloudFront
- HIPAA §164.312(e)(1)
- PCI DSS 6.4.3, 11.6.1
Amazon CodeGuru Reviewer
- PCI DSS 6.2
- ISO 27001 A.8.28
Amazon S3
- HIPAA §164.312(c)(1)
- ISO 27001 A.8.10
AWS Certificate Manager
- HIPAA §164.312(a)(2)(iv)
- ISO 27001 A.8.24
AWS CloudHSM
- HIPAA §164.312(a)(2)(iv)
- ISO 27001 A.8.24
AWS KMS
- HIPAA §164.312(a)(2)(iv), §164.312(c)(1)
- ISO 27001 A.8.10, A.8.24
Amazon Q Developer
- PCI DSS 6.2
Amazon Verified Permissions
- HIPAA §164.312(a)(1)
Amazon VPC
- PCI DSS 1.2
API Gateway
- HIPAA §164.312(e)(1)
AWS CodePipeline
- ISO 27001 A.8.28
AWS Control Tower
- ISO 27001 A.5.23
AWS Firewall Manager
- PCI DSS 1.2
AWS Lambda
- PCI DSS 11.6.1
AWS Shield
- ISO 27001 A.5.7
AWS Site-to-Site VPN
- PCI DSS 1.4
AWS Transit Gateway
- PCI DSS 1.3
AWS Trusted Advisor
- HIPAA §164.308(a)(1)(ii)(A)
AWS WAF
- PCI DSS 6.4.3
Elastic Load Balancing
- HIPAA §164.312(e)(1)
How the evidence keeps flowing
AWS Audit Manager closed to new customers on 30 April 2026. This pipeline is what we ship now, and it runs after we leave.
AWS-published Operational Best Practices for AICPA SOC 2 conformance pack. Deploy Org-wide via StackSets.
AWS Foundational Security Best Practices standard — most SOC 2 CC controls have a 1:1 finding mapping.
Auditable event store with SQL queries — observation-period evidence for the Type II audit window.
Vanta, Drata, or Secureframe wired to AWS read-only — control evidence dashboard your CPA firm logs into directly.
What you get, week by week
A date-bound engagement, not an open-ended retainer. Every deliverable is itemised in the statement of work.
Weeks 1–2 — Readiness Assessment
Weeks 1–2
- TSC scope decision — Security only, or Security + Availability + Confidentiality (most common SaaS scope)
- Control gap matrix mapped to CC1–CC9
- Inherited-control mapping to AWS SOC 2 (Carve-Out Method)
Weeks 3–8 — Control Implementation
Weeks 3–8
- AWS-native control deployment (Security Hub, Config, GuardDuty, IAM Identity Center)
- Policy library — Information Security, Access Control, Change Management, Incident Response, Business Continuity, Vendor Management
- GRC tool wired to AWS — Vanta/Drata/Secureframe collecting evidence
Months 3–12 — Type II Observation Window
3–12 months
- Continuous control operation — typically 6 months for first Type II, 12 months for renewals
- Quarterly internal audit and findings register
- Evidence sampling for the CPA firm — pulled directly from GRC tool
Audit + Report
4–8 weeks
- CPA firm fieldwork — typically 4–6 weeks
- Management response to any deficiencies
- Final SOC 2 Type II report — distributable under NDA to your enterprise prospects
Further reading
Deeper reading on SOC 2, and the frameworks (in navy) most teams certify alongside it.
How to Achieve SOC 2 Type II Compliance on AWS (2026 Checklist)
SOC 2 Type II certification proves your controls are effective over 6-12 months. This guide covers the compliance roadmap, AWS security controls, documentation requirements, and audit preparation for 2026 certification.
Read the guideAWS IAM Best Practices: Least Privilege Access Control
Least privilege is easy to say and harder to run at production scale. This covers roles vs users, permission boundaries, SCPs, identity federation, and the access-control patterns that keep teams fast without leaving keys lying around.
Read the guideHow to Set Up AWS Security Hub for Compliance Monitoring
AWS Security Hub aggregates security findings from 200+ sources and, as of Jul 14 2026, includes AI inventory for org-wide AI assets. This guide covers setup, compliance standards, AI inventory, automated remediation, and a compliance dashboard without hiring a SOC team.
Read the guideImplement Prowler + Security Hub on AWS (Production Checklist)
Production checklist for Prowler and AWS Security Hub: multi-account setup, scheduled scans, finding workflows, and remediation patterns on AWS.
Read the guideWho Remediates Prowler Findings? AWS Implementation Guide
Prowler finds AWS misconfigurations. This guide covers who remediates findings, IaC fix patterns, Security Hub workflows, and when to bring in AWS security consulting.
Read the guideHIPAA on AWS
PHI architecture, BAA boundaries, HIPAA-eligible services, §164.312 technical safeguards, and audit-ready evidence — for healthcare platforms, telehealth, and digital-health startups.
See the frameworkISO 27001:2022 on AWS
Annex A.5–A.8 implementation, ISMS scoping, climate-change context (Amendment 1:2024), notified-body audit prep — for SaaS expanding to EU/APAC and regulated B2B vendors.
See the frameworkCommon questions
- Type I vs Type II — which do we need?
- Type I attests that controls are designed correctly at a point in time. Type II attests that controls operated effectively over a period — typically 6 months minimum for the first audit, 12 months for renewals. Enterprise procurement almost universally requires Type II; Type I is a useful intermediate signal during the first observation window. Plan to run Type II from the start unless you have a deal blocked on a 30-day timeline (in which case Type I buys you time to start the Type II observation period).
- How long does the first SOC 2 Type II actually take?
- Realistic timeline from start to signed report: 9–14 months. That breaks down as 8 weeks readiness and remediation, 6 months observation period (the AICPA minimum), and 4–8 weeks CPA firm fieldwork and report drafting. The fastest path is to run remediation in parallel with the first 8 weeks of observation if your readiness assessment shows minor gaps — but most teams underestimate the policy library and end up extending the observation period to 9 months.
- Which Trust Services Criteria do we include?
- Security (Common Criteria CC1–CC9) is required. The other four — Availability, Processing Integrity, Confidentiality, Privacy — are optional and bundled in based on what you process. Most SaaS platforms include Security + Availability + Confidentiality. SaaS that handles personal data add Privacy. Payment processors add Processing Integrity. Including more criteria lengthens the audit and increases CPA firm fees, so do not over-scope.
- How much does the SOC 2 Type II cost on AWS?
- All figures current as of May 2026. Three cost components. (1) AWS-side: $800–$3,500/month for Security Hub Essentials, Config, GuardDuty, Amazon Inspector, and CloudTrail Lake at mid-market scale. (2) GRC tool: Vanta/Drata/Secureframe typically $20K–$60K/year. (3) CPA firm: $25K–$80K for first Type II, $20K–$60K for renewals — varies by firm tier and TSC scope. (4) Engagement: our SOC 2 readiness + remediation typically lands $40K–$120K depending on your starting posture. Total first-year SOC 2 Type II investment: $90K–$260K.
- Can we use Vanta/Drata/Secureframe instead of a consultant?
- They serve different roles. GRC tools collect and organize evidence — they do not write policies, fix IAM misconfigurations, or design your network segmentation. The pattern that works: GRC tool for evidence collection and auditor-facing dashboard, consultant (us or another) for AWS-native control implementation and policy library, CPA firm for the audit. Companies that try to skip the consultant phase usually have first audits with 15+ deficiencies — passing, but expensive in remediation cycles.
- Does AWS SOC 2 mean we are SOC 2-compliant?
- No — AWS SOC 2 covers AWS controls (the infrastructure your workload runs on). You still need your own SOC 2 report covering your application controls, your access management, your change management, your incident response, and your vendor management. The AWS SOC 2 report is evidence your CPA firm uses to validate inherited controls under the Carve-Out Method. It accelerates your audit; it does not replace it.
Ready for SOC 2?
2-week read-only assessment mapped to the AICPA Trust Services Criteria. We tell you the realistic Type II timeline, scope decision, and CPA-firm options for your stage.
Pictures:Lock and Key (public domain (CC0)); Lock and Key (public domain (CC0)); Coffer lock and key (public domain (CC0)); Padlock and key, André Omereler (public domain (CC0)); Padlock, French (?) maker (public domain (CC0)); Chubb lock (public domain); Safe deposit vault 1908, The Cleveland Trust Company (public domain); The Street Locksmith (6899206616), John Thomson (no known copyright restrictions).Via The Metropolitan Museum of Art and Wikimedia Commons.
.jpg){kind=link}