Pricing a SOC 2 readiness job

Price the engagement, not the hours. A Canadian SOC 2 readiness engagement for a thirty person SaaS company is a $25,000 to $45,000 CAD piece of work, and the firms that lose money on it are almost always the ones that quoted before asking four specific questions.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

The market rate for full SOC 2 readiness in Canada runs roughly $15,000 to $70,000 CAD depending on client size and starting state, with a thirty person SaaS company that has the basics working landing between $25,000 and $45,000 CAD. Those are the same figures this site publishes to buyers on the readiness consulting page. Quoting a number a client can look up and verify is a stronger position than quoting one they cannot.

Underneath the range, day rates for Canadian compliance and security consultants run $1,200 to $2,400 CAD, with independent practitioners at the low end and partners in established practices at the high end. Almost nobody should quote SOC 2 readiness on day rate. Where the work comes from matters too: a client arriving through an audit firm referral will accept a higher number than one who found three firms on a search results page.

Fixed fee or time and materials

Fixed fee for the readiness engagement itself. Time and materials for the open-ended work around it. Mixing them up is the most common pricing error in this market.

The four questions to ask before quoting

Every readiness engagement that goes badly failed at scoping, and the failure is usually one of these four.

1. Who is doing the remediation? If your scope says you will implement controls in their environment, you have taken on their engineering backlog at a fixed price. Either scope yourself as advisor and let them build, or price the build separately with named work items.
2. Which Trust Services categories, and did a customer name them? A client that adds Privacy and Processing Integrity halfway through has roughly doubled your control set. Fix the categories in the scope document and price a change.
3. What does their environment look like? One cloud account with infrastructure as code is a different job from three accounts, a legacy colocation rack and an acquired team's environment. Ask before you quote, not during kickoff.
4. Is there a date, and who set it? A client whose deal closes in nine weeks will consume unlimited attention. That is legitimate and it should be priced. The deadline calculator is a useful thing to run with them on the first call, because it makes the arithmetic somebody else's.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What to anchor against

Readiness gets compared against three things, and only one of them is a real comparison.

Clients compare it against the audit fee, which is the wrong comparison. Readiness frequently costs more than the examination, and that surprises people who assumed the auditor was the main expense. Say it in the first meeting with the full four-line budget in front of them, so the number arrives as context rather than as your quote being high.

They compare it against a compliance platform subscription. Correct that plainly: a platform collects evidence. It does not decide what your controls should be, write your policies, or answer the auditor. And they compare it against doing it themselves, which is the real comparison. For a disciplined twenty person company with an engineer who will own it, doing it themselves is the right call, and saying so wins more work than arguing does.

Where readiness engagements lose money

Scope creep through the request list

The auditor's request list arrives and the client forwards it to you. Unless your scope says who answers it, you have just acquired weeks of unpriced work. Cap it, or sell it as a separate block.

The unbounded policy review cycle

Two rounds of comment is a scope line. Without it, a client with an opinionated general counsel will produce nine.

Waiting on the client

A fixed fee with no time boundary means their six week delay is your margin. Put an outside date in the scope after which the engagement re-quotes.

Tooling nobody paid for

If your method depends on a platform, either the client buys it or you price your licence into the fee. Absorbing it quietly is a per-client cost that grows with your business.

Free work during the sale

A prospect asking for a gap assessment as part of the pitch is asking for the first deliverable free. Price the gap assessment, credit it against the engagement if they proceed, and hold the line. The exclusions section on a proposal is where most of this gets settled.

Should you publish your prices

Yes, as ranges with the variables named. The argument against is real: publishing invites competitors to undercut you, removes your ability to price to what a particular client can bear, and moves an uncomfortable conversation onto the website.

What outweighs it is qualification. Almost nobody in this market publishes anything, so a buyer researching three firms gets three "contact us" pages and picks on the call. A published range means every buyer who reaches you has already accepted the order of magnitude. It costs you only the deals you were going to lose on price. It also lets you say something specific about what moves the number, which is the part buyers want and cannot find.