Do we need to hire someone for SOC 2?
Almost never for the report itself. A first security hire costs more than the entire audit, takes three months to recruit, and solves a problem you have after the report rather than before it.
For a first SOC 2 at a company between 15 and 80 people, hiring a security person first is usually the wrong move. A security engineer or manager in Canada costs $110,000 to $180,000 CAD a year plus recruiting time, more than the entire first-year audit, and the search takes eight to sixteen weeks you do not have if a customer is waiting. Three of the four options below beat hiring for a first report.
8 to 16 weeks To recruit a security hire in Canada
$6,000 to $15,000 A gap assessment, the highest-return purchase
The four options, priced
| Option | First-year cost | Best when | Fails when |
|---|---|---|---|
| Internal owner, no external help | $0 external, 200 to 500 hours | Engineering-led, under 30 staff, no hard deadline | Nobody has the hours, or nobody knows what an auditor accepts |
| Internal owner plus a one-off gap assessment | $6,000 to $15,000 | Almost every first-timer. The cheapest way to stop building the wrong evidence | The gap list is produced and then nobody is funded to close it |
| Fixed-scope readiness consultant | $15,000 to $60,000 | A hard customer deadline, or genuinely nobody internal to own it | The consultant does the work and leaves with the knowledge, so year two restarts |
| Fractional CISO, ongoing | $3,000 to $12,000 per month | You will keep needing security leadership: questionnaires, customer reviews, a second framework | Used purely to get one report, where a fixed-scope project costs less |
| Full-time security hire | $110,000 to $180,000 salary | Ongoing program, multiple frameworks, security is part of the product | Hired to produce a first report, which they will spend their first quarter learning your systems to do |
| What most 15 to 80 person Canadian companies should choose first | Internal owner plus one gap assessment, $6,000 to $15,000 CAD | ||
Those readiness numbers are the same ones on the CAD cost breakdown, and the choice between consultant models is the consulting page. The fractional model in detail is a vCISO for SOC 2.
What a hire does not fix
The two things that stall a first audit are unfunded ownership and missing evidence inside the window. A new hire fixes neither on the timescale that matters. Somebody has to have hours, and a new employee has none for the first month while they learn your systems. Somebody has to chase colleagues for evidence, and a person hired last month has less standing than the founder does. Where each task should sit in a company with no security function is on SOC 2 with no security team.
The one hiring case that is clearly right
If your product sells on security, if you are heading for a second framework, or if you are already answering more than two customer security reviews a month, hire. The report is then a by-product of a program you need anyway, and the comparison on this page is the wrong one. Do not use a first SOC 2 as the justification for the hire. The hire will be judged on a deadline it cannot control.
If you do bring somebody in
Ask a consultant or fractional these directly.
- How many first-time SOC 2 engagements have you taken through fieldwork, not just readiness. Readiness experience without fieldwork experience produces evidence auditors then reject.
- Will you be the person doing the work, or is this a partner selling and a junior delivering. Both are fine, and you should know which.
- What is out of scope in your fee. Policy writing, evidence collection during the window and fieldwork support are the three that are commonly excluded and commonly assumed.
- Are you affiliated with an audit firm. If they are, independence rules mean hiring them may cost you that firm as your auditor.
- What do we own at the end. A consultant who leaves with the spreadsheets is a consultant you rehire every year.
The proposal you should expect back, and how to compare two of them, is on what a readiness proposal should contain.
Do this before you decide
Count the hours honestly first. The decision gets made on whether anybody feels confident, when the input that matters is whether anybody has twelve to sixteen hours a week for a quarter. How much time SOC 2 actually takes has the phase-by-phase numbers, and the readiness scorecard shows how much of the work is already done, which moves the answer more than any other factor. A company with single sign-on, ticketed changes and centralised logging already in place needs far less help than one without.
Do we need a CISO to get SOC 2?
No. Nothing in the criteria names a job title. CC1 requires that responsibility is assigned to a competent person with appropriate authority, and a founder or engineering lead who owns it explicitly satisfies that.
Is a fractional CISO worth it for one report?
Usually not on cost alone. At $3,000 to $12,000 CAD a month over six to nine months you are near the price of a fixed-scope readiness project with a defined end. The fractional model earns its money when the need continues past the report.
Can our auditor also help us get ready?
Generally not, and this catches people. Independence rules mean a firm that performs your readiness work usually cannot audit it. Two firms is the normal structure rather than a failure to negotiate.
What is the cheapest useful external help?
A one-off gap assessment at $6,000 to $15,000 CAD. It tells you what an auditor will accept before you spend a quarter producing evidence in the wrong shape, which is the most expensive mistake a self-directed team makes. The gap analysis page covers what it should produce.
Should we hire a compliance manager instead of a security engineer?
For the audit specifically, a compliance-minded operations person is often more useful than a security engineer, because most of the unfilled work is chasing, documenting and scheduling rather than engineering. The technical remediation is a job for the engineers you already have.
Compare readiness firms before you hire
Tell us who owns this internally and how many hours they have. Firms quote against that.
Get matched